hxxp://t[.]me/BACKDOOROBLOX

Analysis

user interaction
yes
max time kernel
538s
max time network
534s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 10:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://t.me/BACKDOOROBLOX
Sample260709-l6892ahs4s

Score

8^/10

credential_access discovery persistence privilege_escalation pyinstaller ransomware spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
252	960	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
4248	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe

Loads dropped DLL 29 IoCs

pid	Process
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe
2196	Roblox_BackDoor_v1.1.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
256	icanhazip.com
257	icanhazip.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000800000002459b-645.dat	pyinstaller

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1200	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
960	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280654101632614"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Opens file in notepad (likely ransom note) 3 IoCs

ransomware

pid	Process
5544	NOTEPAD.EXE
5552	NOTEPAD.EXE
536	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
5896	chrome.exe
5896	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs

pid	Process
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe
Token: SeShutdownPrivilege	2932	chrome.exe
Token: SeCreatePagefilePrivilege	2932	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
5544	NOTEPAD.EXE

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe
2932	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 4596	2932	chrome.exe	85
PID 2932 wrote to memory of 4480	2932	chrome.exe	86
PID 2932 wrote to memory of 4480	2932	chrome.exe	86
PID 2932 wrote to memory of 960	2932	chrome.exe	87
PID 2932 wrote to memory of 4792	2932	chrome.exe	89
PID 2932 wrote to memory of 4792	2932	chrome.exe	89
PID 2932 wrote to memory of 5292	2932	chrome.exe	90
PID 2932 wrote to memory of 5056	2932	chrome.exe	91
PID 2932 wrote to memory of 5292	2932	chrome.exe	90
PID 2932 wrote to memory of 5056	2932	chrome.exe	91
PID 2932 wrote to memory of 5704	2932	chrome.exe	92
PID 2932 wrote to memory of 5704	2932	chrome.exe	92
PID 2932 wrote to memory of 3316	2932	chrome.exe	93
PID 2932 wrote to memory of 3316	2932	chrome.exe	93
PID 2932 wrote to memory of 5464	2932	chrome.exe	94
PID 2932 wrote to memory of 5464	2932	chrome.exe	94
PID 2932 wrote to memory of 1804	2932	chrome.exe	95
PID 2932 wrote to memory of 5276	2932	chrome.exe	105
PID 2932 wrote to memory of 1912	2932	chrome.exe	106
PID 2932 wrote to memory of 3600	2932	chrome.exe	107
PID 2932 wrote to memory of 2144	2932	chrome.exe	108
PID 2932 wrote to memory of 2144	2932	chrome.exe	108
PID 2932 wrote to memory of 5988	2932	chrome.exe	109
PID 2932 wrote to memory of 5988	2932	chrome.exe	109
PID 2932 wrote to memory of 1536	2932	chrome.exe	111
PID 2932 wrote to memory of 1536	2932	chrome.exe	111
PID 2932 wrote to memory of 2152	2932	chrome.exe	112
PID 2932 wrote to memory of 2152	2932	chrome.exe	112
PID 2932 wrote to memory of 5576	2932	chrome.exe	113
PID 2932 wrote to memory of 5576	2932	chrome.exe	113
PID 2932 wrote to memory of 2708	2932	chrome.exe	114
PID 2932 wrote to memory of 2708	2932	chrome.exe	114
PID 2932 wrote to memory of 6024	2932	chrome.exe	115
PID 2932 wrote to memory of 6024	2932	chrome.exe	115
PID 2932 wrote to memory of 3864	2932	chrome.exe	116
PID 2932 wrote to memory of 3864	2932	chrome.exe	116
PID 2932 wrote to memory of 5288	2932	chrome.exe	117
PID 2932 wrote to memory of 5288	2932	chrome.exe	117
PID 2932 wrote to memory of 2304	2932	chrome.exe	118
PID 2932 wrote to memory of 2304	2932	chrome.exe	118
PID 2932 wrote to memory of 4032	2932	chrome.exe	119
PID 2932 wrote to memory of 4032	2932	chrome.exe	119
PID 2932 wrote to memory of 1056	2932	chrome.exe	120
PID 2932 wrote to memory of 1056	2932	chrome.exe	120
PID 2932 wrote to memory of 1576	2932	chrome.exe	121
PID 2932 wrote to memory of 1576	2932	chrome.exe	121
PID 2932 wrote to memory of 4796	2932	chrome.exe	122
PID 2932 wrote to memory of 4796	2932	chrome.exe	122
PID 2932 wrote to memory of 1648	2932	chrome.exe	123
PID 2932 wrote to memory of 1648	2932	chrome.exe	123
PID 2932 wrote to memory of 412	2932	chrome.exe	124
PID 2932 wrote to memory of 412	2932	chrome.exe	124
PID 2932 wrote to memory of 1364	2932	chrome.exe	125
PID 2932 wrote to memory of 1364	2932	chrome.exe	125
PID 2932 wrote to memory of 4128	2932	chrome.exe	126
PID 2932 wrote to memory of 4128	2932	chrome.exe	126
PID 2932 wrote to memory of 4636	2932	chrome.exe	127
PID 2932 wrote to memory of 4636	2932	chrome.exe	127
PID 2932 wrote to memory of 1188	2932	chrome.exe	128
PID 2932 wrote to memory of 1188	2932	chrome.exe	128
PID 2932 wrote to memory of 3364	2932	chrome.exe	129
PID 2932 wrote to memory of 3364	2932	chrome.exe	129
PID 2932 wrote to memory of 2840	2932	chrome.exe	130
PID 2932 wrote to memory of 2840	2932	chrome.exe	130

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://t.me/BACKDOOROBLOX
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc5412c728,0x7ffc5412c734,0x7ffc5412c740
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,14035160712990923284,2220686963792110403,262144 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1568,i,1238564893689392629,8979287231024235273,524288 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,4367050321848285648,4467772062673981265,524288 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3092,i,8741715753905521391,5902981024454237479,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3108,i,1839046823692592181,3043846340259776436,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4412,i,6331506239488027002,699675910525361329,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4424 /prefetch:2
  2⤵
  PID:5704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4664,i,14950515792545594932,13434551888393960966,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3128,i,1483534533921382371,4361531377476113027,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,1199805054117304985,15571017836557406430,524288 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,8087947658273590529,6488837396866671254,524288 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:5276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,11336613418374001483,9263622902594013057,524288 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,6108872275734783699,10038486103748614067,524288 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:3600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4424,i,11620404101285315872,15378903200604440276,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5692,i,3390598738472234278,9737975808407057669,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5760,i,11850261856068923240,2540661666057270479,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5784,i,14758748946594617840,16184632307947918020,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5824,i,3119658540148964265,14258003261755786045,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3384,i,8146567575164419987,17737666785943708117,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5784,i,13655680129889783468,14931537049251163770,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4852,i,11425718176563223772,6317333833473785003,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5628,i,11898694110374487669,13359748137322894844,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5944,i,2936096959729289596,9880293731044735469,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6076,i,7983733586137499538,11369596094662916044,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6016,i,6934726788735789180,9810930601425566647,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6048,i,17233078660387999078,5211564954245444803,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6024,i,2144247379405094183,11051211263563718718,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5336,i,1351847761470827633,1635245521721822277,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3380,i,10008914799356211573,10494379577322043368,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6296,i,5245503735376270137,9812621155024564898,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6228,i,13677899603507039127,13532171487280917324,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6048,i,5004100138197726952,4352805749258771395,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6268,i,13070886032316244399,994737679082486307,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6312,i,12713430041521255048,8923955595592143737,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6544,i,6722822394936795803,4028851850255681162,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6112,i,6099419062504512469,8496337395320828788,262144 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,12131395443862296454,4665149024084928025,524288 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6360,i,5912857063864172173,11590590815335807156,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1172 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=5848,i,7805340265572459688,17940255707080179975,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=1168,i,8941637069205767484,4413275462857712591,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=6216,i,4326113583786892949,15335700777724479118,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=5896,i,5708710106738720074,5490648855144869127,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6380,i,14597898031350179865,14137347950748641992,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=6732,i,13031032604203950831,652473734915950122,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=5344,i,16866169335536179254,14116508219084400371,2097152 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7640,i,16197782446107855519,2517011337686095115,524288 --field-trial-handle=2004,i,17734481510480038687,7710577131710968561,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7688 /prefetch:8
  2⤵
  PID:5584
- C:\Users\Admin\Downloads\Roblox_BackDoor_v1.1.exe
  "C:\Users\Admin\Downloads\Roblox_BackDoor_v1.1.exe"
  2⤵
  - Executes dropped EXE
  PID:4248
- - C:\Users\Admin\Downloads\Roblox_BackDoor_v1.1.exe
    "C:\Users\Admin\Downloads\Roblox_BackDoor_v1.1.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2196
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1200

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4368

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6092

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\all_data_with_phones.txt
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:5544

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\debug.log
1⤵
- Opens file in notepad (likely ransom note)
PID:5552

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\all_data_with_phones.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2fdaf459-785d-43db-81cd-e1d68b2235d3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2fdaf459-785d-43db-81cd-e1d68b2235d3.tmp
Size 14KB
SHA256 40401ff4f0a53cee145210e15b62784347024bb6c0c46e43f0011e002ebb0771
MD5 17f2fbe56968d4542bbfca184e7614ef
SHA1 90d3c0dd54de3db445c68f12d61fa5966951b1fa
SHA512 cf185b9ee0091a3e8e07f84ee0da132d0973b650d863b5af9a3c58584666b0861b515d48b039d1b6d9d669a2f048a4b599a7870c8438bc490a343a998f865a96
SSDEEP 192:8RTcBzkgKXqql8Wcv72ympKPRp4MQxxaH95Hsb+WN62X8HcRWCu49gZsjo82XekI:8RTmzkiOIQeXT7w6YG4SsjB2FLE
TLSH
T18662C86BA920657B9CD7D319F92277A7E7F1102626902D84EBFC8B2C14E76CC3217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7a5251d546a4f57167f899909e278cd5f7b33b5ba53afc80b481bb35948355aa
MD5 8b52a8ff5c68998929f68ee29e176789
SHA1 ba7a0680e0cbd7cf1d02ab6ddda3bced72419b4b
SHA512 3cf8f57ac9e045f49201ad75f9c08e8b3afdab155ac2148d731745e30eee7094fbcc7212ff5a640b31d37d6374c09f1249a271a92186fa747c986429d3ff7be9
TLSH
T131E0E5BACA219D2B18FD071824990687E75423572B41495E3A3DD3098FB8A7A0986C2C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 30KB
SHA256 8bcc2c31df569f78eec5714e3d7e973bdbc56ab58d9ceb17f363214d52867641
MD5 6dd1115cfb0e2d299bd4ae517aa6a7c1
SHA1 9d6e953e0b30e4e04420c481a7a05f5a3c2debba
SHA512 8a7082a435dd15711cf1545461c2537ce2f5e275bc07140817cebb6765fca8a2f66c9a48a472082fcaec41c07709daf15588d348698a33265342867875bb0010
SSDEEP 768:rahQAYE94I09Vo9BApanUlh/I4Fz+/DswzTw3qLrPFk:rMQAx4vVaB0L5I4F2Ywzs3+jFk
TLSH
T136D2E175A603EC6F3D1F8C3ABB0E215E7D9ECE5884E46DADE14105DD621E474BC09CA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 80KB
SHA256 39595a1806156cfcadf3cc4e20c5c3f3eec721386a0551790a15f025ba9402bd
MD5 14e39be019da848a73da7658165674cb
SHA1 e016473c4189a8cc3dbff754a48b3e42d68af25a
SHA512 828a383de549871aa80ec960a7e371ef47da96d01ebb9628d1484ceed9eb698aec5109b3de0b24ff8000610a2c2d633616c9fd28d380656fecbaa930cffed029
SSDEEP 1536:kAXTJvOGTDbA80pK0Mdq3wUAVa6BGS8EE/c0Psh6lufc4Ap7QgqHM7zxFX3xzOEm:kAXdJDn3QRoag8pcM6fdAOgq4xNu
TLSH
T17A830296752BB1D4592B012A9EC1F20294222F713DE7D02C15EE4F6E27DBD21698CEA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 22KB
SHA256 e495703032cf8ee1ca49d907a7b5dc172f70f1c848317549c5306733f4ee54c4
MD5 e3bc6c4e7d7cad828b0eeab584ea2697
SHA1 9ae0f8de9715e62ec53125e57047574f2e8fe6bc
SHA512 1bd5806f953148b7033fe394256bd577b2dd913609bb67e372623c8e5f270ae6f3cde8e0ab5a7c187973a0b7e039e2237d70e7d19b1104927c6d80eade569ffb
SSDEEP 384:wy6o24wp4bJagQQTj8grQg4Cb8VlN/EbqCopUXAy5PIjYZzS6pfHSbcelx3Q1Xhv:b6o5wfGUsv6E2CvXA2uUKbtgv
TLSH
T165A2E1D78475C58C344E7F3D2AE6F40E4766B538AD39A3CE1AAC25BDA41D1BB1E34101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 26KB
SHA256 8c4f25fb1d65b0a88d682515c0124e7cdb41493c0865c724be599ac6c763b81d
MD5 ce9d1ee6113e2cf4a97ba3586451043b
SHA1 e30fa87ab74c896e8bc42c4222906f183d743936
SHA512 9cc45106137ac5142da65f90d88216f6608e88db2c55f035b9d29c16ed5d212d7037b4734b1622fdbe8026aab21360db1e6a8e71422aa92c8f049b761f75b046
SSDEEP 768:76XJJzewLtkQHbUiBELP/I212Chn9sufX6vM0yKEojqS2+FXOx15VzuW4Na:2ZdgytBkP/Z12Cd9v6vOKdz2+Nw5Vzgk
TLSH
T12AC2E1D387CA5E12091701E3EB3C1B570A64A583CE2739F2191B16B4A53968BD25B4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 30KB
SHA256 32339f355b5b9b8693f9f6370dca7b05fe6042e3b2d94546afa05d569dd6b66b
MD5 348c832a4560adebb39e32b91f392e20
SHA1 5f8743e97e3d0c418d90998072416705f17eb720
SHA512 c225d7794c5c01872bb1af8a0c6af443f54e07f40cb8c03ed79c77a092ab35e03cbf29e2672cd070e93c998f54fe7776f4ff4e948dfd67af8d77039af6638cb9
SSDEEP 768:5q2yiiih0/n1a/WAfZXxZbFtjd3iXn24He5UKnCljV4fx:k2yOh0da+qZW24Ha3n4x45
TLSH
T10EE2F12E4C58BDF8AF09B230D8C62E76CAF216D7C6D2EED0543DAAFD2529590D18C5C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 151KB
SHA256 a8e7368f03b24867920b42fe31331acf8bde1626336affcee9bd6a9d7daf0692
MD5 c798737fd303ec814cf40d8076bd5d5f
SHA1 0d18fd05f16c17652468175fcc41423a3d99170c
SHA512 31ad0a4e439b706ce0da3a541bad7ed5e5340d086bac526b7872ecfeb722edd9767d99baf72307ae6f79649e3be90542e9034b618dd75db7fc46c19eca72da35
SSDEEP 3072:0EqzX0mMLYGYjNWkUBgpF8djK+nrXXfmlCPaPGOZOaO9TMunLe6EatD:0EoX0mMLYR978dW+njXelCPa3bAYualw
TLSH
T1C8E312AA520A418C573142C80BEF712E499FD0C619DF829B35B4DBFA9974D17270CAAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 20KB
SHA256 8fc0ceddab22a7ab6cbb85ed6b3079cb98ced6f797ddce80745d51be5df830ad
MD5 d18add52269aeb15a4395428d1d81a61
SHA1 6f99404ea8ba60630400959fe17cb250186c027c
SHA512 96177ef9957d3c91e9701991463e43bb682cbd01e2e5a9834e9bdabf985bb50bf6412c18ac4d065871d005c11ed17a75cd0f95936c62da76997728f595c0385d
SSDEEP 384:GUMhGtscuvZc7FylCS8lW9fDmoHF3QL0xnTLBuXPZ0qkUy30nIgW0cbCQCwAjCkc:GUMsscuviyYSb96ugL0lGZ0qnq080wxV
TLSH
T144A2D01BBAB353B6886770E035C9354BD5893158678BA281F41449EFD84A70CF07ADFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e
Size 170KB
SHA256 942ec9c0758c76f4a3ea51efa5dbbd1275eaeeb849254c27c26978a1bfc4122b
MD5 abaf291a6613f68e36730211d152fa2a
SHA1 be20b0e1e6ef6f1383d8b51249e81222b1a23d9d
SHA512 c6ebc7fee8f12ab14b926ce2999f6b23d589d6e76976206c107e15b80d19b3f0dd398bdeb517b8260ec608cbfd4e133c8d943335f763f0466665c00a06a955e3
SSDEEP 3072:x4+jxAX1N+GmShHp8hzX7nMa84+TA0a2VLaNk586nl4vKdDa/oYXgMZXHCceZbWr:x4TX1N+GTHpWL7nfF+ta/kLFDwoedHC+
TLSH
T18004D0A5D0F16FD2C84EE2B5C29F8A26555B013F2B54CC9B62B60AEE9C3411CF44E43B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 b97acf39e85b4ebe7639f161649479a3211faee5842e17e09c2185593d3f6cca
MD5 2bb56dfb752d7e9e259abeb1093d9a6c
SHA1 15aefc637f885e6d358027ea6abc08d276195e84
SHA512 fddb653cb511df3157213758f319372f646e76efaa59636b63107fc119c90bcae0c2699cdedf9998c84ede09c62b655433c76c5fb807712ee5d440929d40f623
TLSH
T1F5E08C50CF2106D5DFA512B8BDDA209439303F806AAAED14A1B314AF2400FE2D525036
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 4c7c87463cae3abe7f6fe56b07ef39f5cc7a951db3070678f1a4ffdde240e4e1
MD5 98e0d0e4393dbe55b2530fc916d4ea42
SHA1 eeb6e756c26f3ae26c6a80adbca1f4aa569e070d
SHA512 635a1fa28a8bc22b3c456b8b286724cf955f0024b88d240b7cb81e8be7eed2b1f1bc225ab74b62036e8d2a5fa0bcc51d50447bfed8d58235b85e2edc5a09ed4a
TLSH
T12AB002116A405456C7C50671D5D1544535761ABD4152599661D520ED5411BF14145461
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 3484fab45fea27e40b6db2fe85fe729b7a078b0ce528d57a7acfe6dec8b0da6a
MD5 90e61d70dc813ce0297f06741dd3e51d
SHA1 a24d4bb9b3d153339a0000e7e475e204320b9915
SHA512 ce9ba2f8eea2b40bb975120f2b11b954d4acb5a4fae272d09eb60a6836c1c9737dd1a274abc2ecf387b15d9ea6417eccb0c51129884290b0407589bf2062f86d
TLSH
T1F2E05E145F1052EACF99837CC9C7719D313006D0E28B5D1151B714ED4C11FD2D09C576
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 5f60968182b16761e827f69cce2b9f8fec5b05bf1619e9e000773e43b298044e
MD5 da59e2c6ec483ef959e5a88c7640a483
SHA1 78d7c719dc3f55b43ed184f549e0614626340563
SHA512 0b623f53f2668fe8b32c108c1f3cf645b661df0637d64334f7d6d8ab39213ff1fef5c254470fe3715decefe730921ff01e037303f5e8559ab4c4db3443ef5278
TLSH
T1FF21DC38DF1C1B82DFF9057558C72A8F3AB07A46D516ED88C071486E7B017F44016836
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 7f13ab7b089cae69321c289cbf35c8679039141acaf22835e8499d57cfa3606e
MD5 b62f170cbfab8da3c3088e1630671721
SHA1 96e3ffcd766a39f2d82626749a0ed64d081977fb
SHA512 4e5e016dc7e8117fe127ae21d19e11cf9dd9a444405eed71b12560103e0a9149096ec2a4279e580184ae55b5bc2db301484f31afa91474247aa9c785f095af96
SSDEEP 384:DLTY2xV+c7JwaJrfxughPJERaIOXLVvSQ0S25pCY1a6rfHsPIyIGNj4IzyggIVxM:rfHWa+RNKPAgCeO
TLSH
T11862BEF7D7D8C62DC8115AF4BB25AE2BCD1D0A28032C3D66C9D4AE0BA7E2471D24165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 71e7591901022956af9301d127568ba350de22dcffb0e275bc7678864ebac6f6
MD5 d5c9dd41fbaf2538c56b436468702039
SHA1 3d1227d69d35cdac32e835ec50bc2803f5735518
SHA512 7073137a3e31ce7a96e65b6bf28a28fe908be1dd09471e55c597b3b011cb9c2d32f03146caf8ded23e5f99862530ab3fcb658f92c3871233ca7039bcee88e798
TLSH
T11B71CFF7D7E48A6DC50196F4AB216E2FCD6D0A25432C3C6688D4BE4B53F2872D24178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 7fc0d14dcaa63967587d9988fcd480f5e8037fca0c94cb8fb3084f515017a91b
MD5 a160f88133b496f8723715273b70620f
SHA1 f02a4bfd640c2dfaa22b872a0485b538dd5a2271
SHA512 c715674ea562fe1833d38bf2df39afc9705bc4346727dc72f8f3c19a4eb981df4fec78cb690ee27dd2dc773200be47982f895c7289995e5b579efa1228b20da5
SSDEEP 384:Dwvk0uV+c7JwaJrfxughPJERaIOXEd7SQ0U5pCY1a6rfHsPIyIGNj4IzyggIVxqa:JfHWS+RNKPqCG5q
TLSH
T16F62DFF3D7D8852DC9115AF4BB25AE2BCD290A28032C3D66C9D4BE0BA7E2471D24165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 0ed71e6a96bd304b94d441cd3b97fef9eb5bbe045a959104e66d0f613cf875da
MD5 a22451b8e1e19e24646cd36ae04c23b8
SHA1 25891558be9c7bea3c072e117689f123633a3a64
SHA512 6248fc96af31b71f1a41e3ae6e065f0d8d8d14614763903182af7b835af6901c722f89a0f94b00121c73bada6b632ab2af6a958fccc97d5a4f8854ae376cc05a
SSDEEP 384:Dwvk0uV+c7JwaJrfxughPJEJx/WaIOXEd7SQ0U5pCY1a6rfHsPIyIGNj4IzyggnQ:JfHWV+RNKPyCGFi
TLSH
T1D572DFF3D7D8852DC9115AF4BB25AE2BCD2D0A28032C3D66C9D4BE0BA7E2471D24165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 469c119e8acd65798756ba3175a20f55eef35bd4d136479ddf7db3bbb6b2d6e6
MD5 a3001e720a174bf8a1687fbe6f75251a
SHA1 28d19daa080186ba71c847cef3040e2cf0a6c5d0
SHA512 c455004b110d421ffbdafd940c3f405fdd9d0d8eefb07da2bb8b5f3d147cccbfc9d4760984d190ec801d02a8b4f382ea11d16182679f821d503f0d906b3120f5
TLSH
T11051DDF787B4863D8A0196F0AA156E2FCE6D0525032C3CA688D4BE5B53F3871D201B8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 dec5a764c62740922a9597170b4eb58b0dd81851f92a3612666f3bd077195efc
MD5 d8120a2d61ce2d223ad22bd59423b753
SHA1 207de699113163ab923cac78e983d0264d000aa3
SHA512 698685f9c0a5d0a84358ca7b8e32ce32bb67a5aa5c168770ec26d77cd6e4c1101ac3f16991c21637e21bc0d99b206f7ba32d163e10c9829b678bff88a8a30b11
SSDEEP 192:wRPkQKXqql4jv72ympAPRp2RI95Hsb+WNnb716Ma8eZ82Xek53VyIsnAUgE:wRPkyTbQUXb7wdxey2FXE
TLSH
T17542B72FAA10657B9CDBD319F9227763E7F5102625902E84EBFC8B1C15E75CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f1f3f13dec8178f4d8d7f824d631fad75c8b75e4d8b68cf8a0a123dc31d0b8bc
MD5 54ac137f2e70285374a4b376170dc98d
SHA1 35d004b15fdf0534dda164def141f5c239f9e6e3
SHA512 b76788ccd63420bc6699bcc15c65324ec7c30103fb1e3cbac8290ce1d22dd1878625cb744afd413d4dc11f6f385f53ca0e355838251b7ff9e2b5b3da8887c762
SSDEEP 192:8RTcBzkQKXqqlYwv72ympKPRp4MQxL95Hsb+WNnX8HJvwFq2J82Xek5DVyIsnAU3:8RTmzkyRsQeXc7wsx72i2FLE
TLSH
T19E52C72BAA206577ACD7D319F9227767E7F1103626902D84EBFC8B2C14E76CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 348fe34b7474b4100a2306d86d8ef4ce184dcb482f8fd78f075de0925ef6eb62
MD5 5c3b37a0ba8de647bed3336530295fb2
SHA1 403558ace06e206542a6a8076e9252c364490470
SHA512 cbc16804c797fac8bcc268fa9484959eb0147e7a2448e633029d3e16019e51bf34641f404118a380105f3995475ae2cd3ab1f13612bcbd9ce38daf7e3bf5d249
SSDEEP 192:8RPkQKXqqluwv72ympKPRp4RL95Hsb+WNnX8HJvcJ82Xek5DVyIsnAUgE:8RPkynsQeXS7wsxci2FLE
TLSH
T19152C82BAA10257B9CD7D319F9227B57E7F5102626902E84EBFC8B2C14E76CC2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9ef69878947b2ea0a43491006d6cf5e781567590878da6f1fa78cc8b80a7d688
MD5 fb2dde8c1a9bae1e2443b612dbca9609
SHA1 d232456982d2894ac0bc30dcdc6ae4b310b59744
SHA512 69cff01320a97256610d92ec03a32efa06fcbe1783dc4008bd6b953c15c9d3ef6b05e236ef7846225ccfaf0ef57a25bb81751c8875a19187bac06205dc6f70b7
SSDEEP 192:wRPkQKXqql4Gv72ympAPRp2Rb95Hsb+WNnb716YX2T82Xek5NVyIsnAUge:wRPkyTyQUX47wd92Y2F5e
TLSH
T19042B72FAA20657B9CDBD319F9227763E7F5102625902E84EAFC9B2C14E75CC3217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 05c162fd10f0753936d83a6ef7d50f3f9a3f022e67b860e498c42c7fbc3fe431
MD5 8db3d968a43e43535c5aa25e63edd575
SHA1 83c518fd6f9c2120f7163a931857dbc975e86b6b
SHA512 1628b55ddcebe4f3ace8ed8414440d0821e431718a2ee579a365d1e5fb23ecf2d8331a92b7a121d90f01d44a518500378540f48b384db45329f0c402467b2555
SSDEEP 192:8RTcBzkQKXqql8Whv72ympKPRp4MQxxaH95Hsb+WN62X8HcRWCu49Yhw3o82XekI:8RTmzkyOxQeXT7w6YG4Ow3B2FLE
TLSH
T15162C86BA92065779CD7D319F92277A6E7F1202626D02D84EBFC8B2C14E76CC3217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 c16be24d4212844328a2d11e35cab1d537667e69829620b6eea5d055a780b2c5
MD5 333f04437a0e93f32cbdd4e7fbdd65da
SHA1 6427f9aeec902bbe9f417e9bf8b521866b05d7b3
SHA512 9959cce179f96f3f29c145fc04e73e9bcabfafe68c24f29dc3161b75970b766356b0f889cb5447e6c30a2b1d53912e35dc19a5c69f1145023113fa7cc3c59ee7
SSDEEP 192:8RTcBzkQKXqql8Wuv72ympKPRp4MQxxaH95Hsb+WN62X8HJvwCu497swv82Xek5S:8RTmzkyOKQeXT7w6xo4Gwk2FLE
TLSH
T13862B76BA92125779CD7D319F92277A6E7F1202626D02D84EBFC8B2C14E76CC3217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b190a48bb52b27e597cf54bd430d2f8f3287926c09faf33b03e867a67124bdc1
MD5 d8a23b4cd3daac97b72d97a7d9d5f637
SHA1 2032c275ca7cdde656210eb7b5b1417cf9cfc33b
SHA512 8511843018883414fe01eb95f2f057c4aeb88eb58c1ee01a61613dc21e9c31be350b545a4bfedb7344b9c806c42c28429b883f3d2a779cfbf0aee57828dbc8eb
SSDEEP 192:8RPkQKXqql4Nv72ympKPRp4Re95Hsb+WNnX8HroED82Xek5DVyIsnAUgE:8RPkyTtQeX/7wssEI2FLE
TLSH
T18952B72FAA11257B9CD7D319F9227B57E7F5102625902E84EBFC8B2C15E76CC2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 eb9392f48b31a30b4f0182d7daf8b769d08c56d82a71453d0835bf9b1f4cf8c4
MD5 b30c99ef3a6a3db8e3dbdcbab9869a42
SHA1 3c1cb0def7ab0406a8ee40a32b2c9cf594e8847e
SHA512 f5c89c13de2e37ae77da1b49c91be132bda64129f1449e34dd843c586037a228c2389dc2e5cb810df9729ce17d22a3b8a677a84fda00a47925370c602d2e7412
SSDEEP 192:8RTcBz0gKXqql8WJv72ympKPRp4MQxxaH95Hsb+WN62X8HcRWCu49QBmE82Xek5S:8RTmz0iOJQeXT7w6YG4Km92FLE
TLSH
T19562B86BA920697B9CD7D319F92277A6E7F1102626902D84EBFC8B1C14E76CC3217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 11a873cdcd0316cb7178f7a02734d9596768b859722bf8f456bb32826ea5f5ef
MD5 8e0a534a997e078678675962681e3944
SHA1 126df712a74711719e46c17e6da4f0fa1ebce097
SHA512 3711217ddf5f35dfc0f6ba8528c44cbbac99dd241d3066dff26c8644c6888a32fdce8c8cc91673d91bbce8c90538a4da3f3b10db3371072a7e0a1e67b3cd67b1
SSDEEP 192:wRPkQKXqql48v72ympAPRp2Re95Hsb+WNnb716h2Y082Xek53VyIsnAUgE:wRPkyToQUXR7wd9Yt2FXE
TLSH
T19F42B72FAA10657B9CDBD319F9227763E7F5102625902E84EBFC8B1C15E75CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 782d23f4ecfe01a44df3beaf060bd39d26c27f9c033fa4e3c5cd24c0497b2b3c
MD5 71256192dece2081f4a08cadeb45b077
SHA1 17d9a7088cbe043c9234691fd186ae1aef66f408
SHA512 7648181d624dbcd9fff14e1ac514f32d12a1bc449b342263e8f6e8b3932d3244538c44951c4d53ac1dd864200675d06e10a723f08aab718d606ced9a8b4b4a7f
SSDEEP 192:8RTcBzkgKXqql8WVv72ympKPRp4MQxxaH95Hsb+WN62X8HcRWCu49TEUIo82XekI:8RTmzkiOlQeXT7w6YG4KUIB2FLE
TLSH
T15362C86BA920657B9CD7D31DF92277A6E7F1102626902D84EBFC8B2C14E76CC3217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 dcf4c27e8c3b2c5213f6170dba52e19c773f23430b70ae87353073fd087a4e52
MD5 8ed97e5da0c6325e64c600eb0709d736
SHA1 bdcc6189cd643cabc41ab50fbf0f0a2d0210a856
SHA512 3a3872115cb5e93abbed46861cf55fb51800b37734a4782a2a789cc51eeb1c85d693b12994c3cd4bfc7f18a2ab741d0b52f778714836b54d1760e1f43b4ca4c6
SSDEEP 192:8RTcBz0gKXqql8Wxv72ympKPRp4MQxxaH95Hsb+WN62X8HcRWCu49QBmE82Xek5S:8RTmz0iOhQeXT7w6YG4Km92FLE
TLSH
T14962C86BA920697B9CD7D319F92277A7E7F1102626902D84EBFC8B1C14E76CC3217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 014329abb773ce4379fb95dcb1506b826f03bfc7581a1fff10fe9a1c3f1f54f7
MD5 844b2e2e45dae7d6b00c14bddf901176
SHA1 6843093680649153c8804430948bf936556e0d9c
SHA512 42de494df0329239883860eebddb2d00e22189fb2d311bda25620df6cb9dc6bbd88dfbb190a8456837371181753a37dddcc9baddcdb39a3b1de593383efda3c6
SSDEEP 192:8RTcBz0gKXqql8WGv72ympKPRp4MQxxaH95Hsb+WN62X8HcRWCu49QBmE82Xek5S:8RTmz0iOyQeXT7w6YG4Km92FLE
TLSH
T17962B86BA920697B9CD7D319F92277A7E7F1102626902D84EBFC8B1C14E76CC3217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 003234b56d25ba8203ea4e8277f713be3a53e0974ceb7eca9d34ae34934f90f0
MD5 2ce1bfb5b66260f6a9b7ddf3733f5346
SHA1 8483aaf4c6901b7099fa9187857b461b5ae1d476
SHA512 758ba30760fb24684b27732d6ab3523dc52fbfa7ef08e26cf17ea5876c3774c70bc3d0563e010ccdc391497af53e4d7c9b961aadca00bf519153401dd1e153ac
SSDEEP 192:wRPkQKXqql4Qv72ympKPRp4Re95Hsb+WNnb716roEn82Xek5DVyIsnAUgE:wRPkyTMQeX/7wdlE82FLE
TLSH
T1FD52B72FAA10297B9CD7D319F9227B63E7F5106625902E84EBFC8B1C15E76CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 20744366ebcaf3a1ad781afb1819eba6cc6b93d12814f21c78a2767a2829cc26
MD5 e68be80806cbf1563791d660cbe6b6f7
SHA1 51f1dfbab92a5a2594b2833aaf3b6d3e294f34f1
SHA512 5005d673a1eacc0816195f71bff7b696d3967ac6bceb1c89cc65ccd3610369453be661a08d8d727b9b0ffb17345d6e927384b30441b2724f38de0348234a1595
SSDEEP 192:8RTcBzkQKXqql8Wwv72ympKPRp4MQxxaH95Hsb+WN62X8HJvwCu4e682Xek5DVyN:8RTmzkyOsQeXT7w6xo4e/2FLE
TLSH
T1AD52C76BA92029779CD7D319F92277A7E7F5102626902D84EBFC8B2C14E76CC3217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 373df78e3bd65ee6f159e423fc186164774a31c0e63c5fae3a062c762452827e
MD5 429de2aa742c8e38cb9c656c8fc70195
SHA1 d5df01dc6edb04c0e9c861af4e60ce74eb89a0b5
SHA512 3c2251ab14875d93adbfcb9cec69b78aceef9b36c499b600f916c37436600ddaeda12904c3144ab32eeedad33bc1ba68cee0b8517baaa780a81d507263d0b7ea
TLSH
T180B01280C0026912C40603F4114B248872249F51A60B1B0153E179669825190C224160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58532c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58532c.TMP
Size 96B
SHA256 0ea8ee7099f9415c0aef50c549349f3d89177aa14ef8a344581995cbb36dbdbb
MD5 d63cdee8628e66bee9ef9ebf04234c0b
SHA1 35a1a429b18266ef61d9d8479cb337389c828814
SHA512 449f41d4adda143678806b3b17b3b10199b7ff24d914125000e2da7dc3954e61fa70d693af2c9687c10f55b63628b20f73aeccd5d33cf2e981a57aa38f8d727d
TLSH
T174B02200C2023203C00203B038808CFE3030CF20C2030B02A2E00A2FCC30AA00230030
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 f2425c1739581bab51538515197e594fdf72fb6db26af61b5f02264bd40b396d
MD5 649671078765bb0fb67797a81b1a1e47
SHA1 0058a851619a4f0d7339a3ad4dad411a6d780b0e
SHA512 432529dd5637c12c66d8e350368ea0095b85181d3db9803a75a67cd595643b0f627dd7d376f7aa575bf71163497402b729fd2c673803eb95cb5d7d558735e50c
TLSH
T1F5A0021611C51D11EB000674628157D47724C85163429203C09140D99C575925907654
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 45d8aa356fa968e60233346d1b487ce9c9834c233ccb584c33b7de8b4bf66d5e
MD5 499f13528eba29a02d01f4cdf78f89d1
SHA1 f308f93f4b297450f17ea6a653b78b23e9e22769
SHA512 541748ff4cc3c43506afe3b5f724f2ebfdbd6e80d426daeed642d0dce6a6a7a9a0c2defea08ef85d91778606674c57795edd35cc5f0bdace41fb96108c5cc775
SSDEEP 1536:+vyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:kqfd7NtZL8cHQRZEQ6Spsk
TLSH
T121C30237DFC61E339DC2DB60B9130ED693FA44A99034D305EA7D67AB6C83495A44289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 71f8d7866557708b59596e3bbb2ce1e89b1ba9b07dc91fdeedf09c10b9b69c4e
MD5 84c65edcc124e5cfb1fabe77c8c3933a
SHA1 aed54d3425603ec86aa0ae7e06004ad553d0aa8e
SHA512 60547eb43bc344e68ef519f2f4b3b1e6b9338119d20e3c626860b47bb641a98b8cbacab72e3adee1fc51242f6b3313b61a1b4ae66839eecc31f9b0cf0e14539f
SSDEEP 1536:+FyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:+qfd7NtZL8cHQRZEQ6Spsk
TLSH
T10EC30237DFC61E339DC2DB60B9130ED693FA44A99034D305EA7D67AB6C83495A44289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ea9989ad9d0c020369b3bf122d5c4ce97fc8b2feb1ad45e62deb6fc6c68926ac
MD5 b5ba2461a93a873d237671a8a23886a4
SHA1 e21682e683a9fa8bf098ef73b1fbfb8f621b21e1
SHA512 a4ab7a9d8700b9e4e51514ff5cd8be720e3d5c153c18470bfbba62ba51eaeb830f4e5fe906858558a0e8d8ce2bfd93f05a6cbdb614e8b78a58b015a678a9c119
SSDEEP 1536:+ayD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:Jqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1A5C30237DFC61E339DC2DB60B9130ED693FA44A99034D305EA7D67AB6C83495A84289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b88ec627d8672a4c8a4d78ff40bbc10d9a8251bebf6bb92ddb5baffab45cf3e4
MD5 af2ef131757ea77f16bba97e7fcff227
SHA1 1e8b82c0ee361bb42c7c55c2f3cfc182a1590126
SHA512 64fa7f017c039cee80eac963396c94692c5824b2a5217860148cea95b1acf03545a15ca9b77030065cff0173589ab5edf86f4c9c30c6f2dc58b8e32ea5dddd60
SSDEEP 1536:+QyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:zqfd7NtZL8cHQRZEQ6Spsk
TLSH
T129C30237DFC61E339DC2DB60B9130ED693FA44A99034D305EA7D67AB6C83495A44289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 11c885ef6a95658afc83fa5a84a9937dbcb3f9abe8ae18671dcfd0950ca62388
MD5 3f8706be83121d1cf375ec4c4310cff1
SHA1 10ba1881e26f557e47d800f515aa5db17739ad63
SHA512 9352198eb788d2ceed3ddc14cd8aa2a37545b800998484a988dc873c9ead89e96ceba7e927c9bee882c07496a3151254b6601c1e40ee8449162472a1034b0647
SSDEEP 1536:tUxPyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:sxqfd7NtZL8cHQRZEQ6Spsk
TLSH
T19CC30237ABC61E339EC2CB70B9130ED797B944A99034D305ABBD27FB6C83495654289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 aa2fb7afa0f3bc7334d3dcdd426ac533ae5b41785872eb7a99f2d196c89020a5
MD5 f1b7cfddae5919478ccc3d529b2a3bcd
SHA1 17b2e65fc56055099dc8c9e9a1c3464527d86103
SHA512 a22d203e41e2f0eb296906b4e49c7bddbf8ab69bb27dcfa7a72002ea1a8bf8c4bc8b596e20efcf0a07eea997929331cbaacf5c3a9455bcbad043ea76e094845f
SSDEEP 1536:+UxPyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:/xqfd7NtZL8cHQRZEQ6Spsk
TLSH
T172C30237ABC61E339EC2CB70B9130ED797B944A99034D305AB7D27FB6C8349565424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c41e8c20d5b0dfa47356a9fbc6597aa17fd5dd871241ee783cf025e79cd7eacf
MD5 0bbab6f58552bde735b6ecfb926ad873
SHA1 b01a7326cf56bc6c33de61987696b9f27de59e0d
SHA512 991319a1b159cb57fbbc0ca3530851e2e1157d8073eaa1f1ef832b73585f41fd7c9a10ac3dcae21d436254c176f258c48b722d84dd1d577e3c0d4bcd0120384c
SSDEEP 1536:TsQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:9qfd7NtZL8cHQRZEQ6Spsk
TLSH
T18FC30237DBC21F339D92CB60B9530FD697BA44A99034D301AABD77AF6C83491644289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 9853563da602b86d726664e087bb2a99d4cd8e3592a8ebd29f39ccfe3b53cf4e
MD5 af9eb466c470a46c379398133e1e4023
SHA1 a257492af8d5c2ec8538b0b613fb3208cf1acbd9
SHA512 fd17cc196fb3264593458c650ce227a5fbbaf4c33fbe94e937f462642aa9a931a0e8201ecf04e32f4bd7a654cc4e1a9e8b34a8ca5acf6b2bcb24e6d818632b0f
SSDEEP 1536:+vyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:kqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1DDC30237DBC61E339DC2DB60B9130ED693BA44A990349305EEBD67AB6C83495A44289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42482\81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
Size 211KB
SHA256 ab64835b63093c31975df2692756c8008e7ec190e4aa86f15a713bcc62e1d432
MD5 2ff9d894ba5e8f7880f0031866203995
SHA1 dd594003fb744f4b2b944e1b10b78a7026e72104
SHA512 461ad7a749cc6131a77883de4108f20922d85618030f5f640da22e95df7db61fe358790e955204bd71efc873b726c130d71f9fb5193e91ec82718d8d19b43a1b
SSDEEP 6144:B8O7Q321soEr5HXN1GY8DNExkP8VXaVHaT8fyFmiGJZMzIfAf1+mrlpL:BT7Q3ZH98LnYlpL
TLSH
T15324173951580061ECB74275CD67E453EAB2F222473192CF09E0CA761F2B7E5BE79B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42482\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42482\_bz2.pyd
Size 85KB
SHA256 d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11
MD5 207d4a4b7a113ef494514918f2dccdf3
SHA1 74b59453b5bb6194e0d2587d26d499d0f7e1aed5
SHA512 f7e5a2608ee19fd400d4bfe27e8603289a219af6a4a4a9e65ebb76c715d926fb9b08293fc2a3fed2195784804764265fa0b356547f23c501ec8ff9487c948b27
SSDEEP 1536:xtMtz7eksNCb6YVVEFxO2RqOyuzotWw8pRbIiQIG3VTy1Ni9QfIY6utw:PMtzSqurjOqqfgotWrplIiQIG3VtKtw
TLSH
T14A837E86B3B462B6F59B81B496910353F730FF960710A3BFB25482863F13B91AF58365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42482\_ctypes.pyd
Size 139KB
SHA256 25d9b0be550d428fecc697ca20450343a7c3ce77c9f5283e9aecfd188d609250
MD5 eeabc0c7756ed7a29e33e467c398737f
SHA1 ec5c401946a9df4e4ab764ddb4639e4e33e1ce40
SHA512 5e1e93545e1be34880fc680ca12004792076e88baa6cac4512fdbbdb90091a9ae441a16b8d24f64c6b03bf14903babddecfa783ce5c016759ed790c0eabc189b
SSDEEP 3072:G/n1qQ8/27N56EBZrGwrb1OzIJswKRW2r7rw8IGGPzoGc:wn1JDT6wrszIJfUDwtc
TLSH
T1A3D38F4B336841E6DA678138C6739E47FBB1F4511A10878F4264C99B2F637A2AE3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42482\_lzma.pyd
Size 157KB
SHA256 5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395
MD5 cada2b240b280f172aeb32a1666b21e6
SHA1 c15dc39329444433c255309eb89bae188aae1b22
SHA512 8b12298efd28549d46e2c48cff94b07039cf513bbac25063ebad8bae57b96e07eefd7df82229441af142c1b96dc837dec468263c0873d14da280e3ed6e42eb9e
SSDEEP 3072:BJ66g4T5QW7JfyjEqkSkA51b4pznfJ9mNopUpdbQIGI1HFk:BUR4Tp4QPZ8N4RxYOgbPa
TLSH
T110F34C86B794F0E6F7328C38D2624F57E6F578590320929A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42482\_zstd.pyd
Size 491KB
SHA256 262aea62a994920daf152a10bdc0ca83a8b1c0874e71db23734862431de182c6
MD5 035b0a033dd00dbe887556f4d4b852c3
SHA1 e86cf52d825f9b68177354c54edaa57e962012c3
SHA512 0b428aa10a9e977e07023918870368a9c00e0eb4ab4f7cf1e88950d4aebd2ba5774ebea9f3779d05e370bbe315da6634922834106077d511b710c6131d29dc65
SSDEEP 12288:KccWmYLKvveeFSeX0ro+Q2J5BCl9VNqdp:KccWJKvveeFSeX0roMZdp
TLSH
T143B48D43F29943EDE53BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI42482\base_library.zip
Size 1.3MB
SHA256 99b7021067ac7867239053755c1bbbe9685c4cc50b148544aed89f24d2732506
MD5 f22c696bd4a9277fa724eb7c1a568093
SHA1 d5e1765df131543d7fb25da0183376b1238a0f87
SHA512 608ffde82c3d8046b74fb684c32c442bfdc90617e28027e28e9dc49f597ebbcfd652eec2925d4ae98ddac3e69549cc4737a41b8ff1ef6e84bb42fd59b5742725
SSDEEP 24576:62bYwdtuUFtL2QeOdP2m2df9lbKDNQZ8Rph3:FYwdtuUF4/Y1RD
TLSH
T16B552BA1B9917967FEC9F37A35B75A0CA715C0109B10D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42482\libcrypto-3.dll
Size 6.0MB
SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
MD5 4191d4288230515c5098cc07f699a604
SHA1 bd8b4d48b2f4513dc378bc5a4cf4a3abbc6998d8
SHA512 c110a89ebb5b58126d556ffea1bf01efb4a6dd295f7387665223741a171d9353315de4d361d3d02a186c1c659aee20f46c579efc51b4c41f7282e1b5b4d6d040
SSDEEP 98304:ybM11p6ZVTRwlFh7V6v73WyXTf0W+JJe1CPwDvt3uFA0CaI:ybM1T6ZlalfV6v7GyXbnEJe1CPwDvt3T
TLSH
T1E6566B5EA7A80188E4BAD13CC6534627D2F1F85A5BB097CF05A196790F33BDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42482\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42482\python314.dll
Size 6.5MB
SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
MD5 006b0746b5abaf438d1bc753261c6d2c
SHA1 8f34714617f376cfa6e7e2aedc1e2a73de8c8fd8
SHA512 1c156c3f542de0a27e16ca5b7d6bbd34f2059b380ce85dbcfd5ae3a64de473fd160baba45ca30ad85dfe45742fdcb42aa969cbbaab26a569e324d4e65fb6d621
SSDEEP 98304:xVyDBH+ULEfi0VOuZd+FAX/uv3HDMiEEQn0rt:xVyD1+ULW5VrZRxim0rt
TLSH
T136669D26737901A5D9BB8035C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roblox_BackDoor_v1.1.exe

Path C:\Users\Admin\Downloads\Roblox_BackDoor_v1.1.exe
Size 14.1MB
SHA256 cd4c09422d4351b1cd2b032c7f49de00d135bb6107ebdf4c036591499f82e2c0
MD5 440c0efc04b8a8d6142406e4c5529a3b
SHA1 6356ed5b834df1c102ea52fbbc11bf2f8410c964
SHA512 1e9a353640ae162b74d2f22dadd7d0e04ab771890d8770f3d054bf960b58b59feec245d5dbd7693150c8775965ea0994f152488bb6c4c2587a6b6bea3777bdf2
SSDEEP 393216:QEZqmhPdMlpLaXEAphVtnIUQSg+MPm5yatBPvu7dvplK:Q4qO2/uRphDto+httpvu7M
TLSH
T187E633A87BC209F6E8F3403C1960D561E2B6B5522F95D5FF0BB50F262E3BAD14D39290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download