hxxps://cdn[.]discordapp[.]com/attachments/977010447477801010/1535378416378052788/robuxsetupwizard[.]exe?ex=6a778c14&is=6a763a94&hm=aab34339c4036865ecb4b400440dd4792f44969e47fde8845220d8a4e663f5dd&

Analysis

user interaction
yes
max time kernel
108s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 20:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/977010447477801010/1535378416378052788/robuxsetupwizard.exe?ex=6a778c14&is=6a763a94&hm=aab34339c4036865ecb4b400440dd4792f44969e47fde8845220d8a4e663f5dd&
Sample260807-yw1lcssglc

Score

8^/10

discovery ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
5	2304	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
4356	robuxsetupwizard.exe
3204	robuxsetupwizard.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2304	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306069422354442"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	chrome.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
1684	NOTEPAD.EXE
4492	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 4800	3444	chrome.exe	86
PID 3444 wrote to memory of 3352	3444	chrome.exe	87
PID 3444 wrote to memory of 3352	3444	chrome.exe	87
PID 3444 wrote to memory of 2304	3444	chrome.exe	88
PID 3444 wrote to memory of 4884	3444	chrome.exe	89
PID 3444 wrote to memory of 4884	3444	chrome.exe	89
PID 3444 wrote to memory of 3200	3444	chrome.exe	91
PID 3444 wrote to memory of 1032	3444	chrome.exe	92
PID 3444 wrote to memory of 3200	3444	chrome.exe	91
PID 3444 wrote to memory of 1032	3444	chrome.exe	92
PID 3444 wrote to memory of 3844	3444	chrome.exe	93
PID 3444 wrote to memory of 3844	3444	chrome.exe	93
PID 3444 wrote to memory of 4084	3444	chrome.exe	94
PID 3444 wrote to memory of 392	3444	chrome.exe	98
PID 3444 wrote to memory of 864	3444	chrome.exe	104
PID 3444 wrote to memory of 2800	3444	chrome.exe	105
PID 3444 wrote to memory of 1828	3444	chrome.exe	106

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/977010447477801010/1535378416378052788/robuxsetupwizard.exe?ex=6a778c14&is=6a763a94&hm=aab34339c4036865ecb4b400440dd4792f44969e47fde8845220d8a4e663f5dd&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff05bfc728,0x7fff05bfc734,0x7fff05bfc740
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,9075032785027639011,1681880866252328503,262144 --field-trial-handle=1996,i,16342177758420993073,2189089026919314613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,866185201886666337,9405458656228627831,524288 --field-trial-handle=1996,i,16342177758420993073,2189089026919314613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,15151896649196878231,6660816324545914144,524288 --field-trial-handle=1996,i,16342177758420993073,2189089026919314613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,5114828191351008801,18184868150231275130,2097152 --field-trial-handle=1996,i,16342177758420993073,2189089026919314613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,14505197209863218873,5621909541152499072,2097152 --field-trial-handle=1996,i,16342177758420993073,2189089026919314613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4368,i,6443773307511835087,18144626120996607057,2097152 --field-trial-handle=1996,i,16342177758420993073,2189089026919314613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4384 /prefetch:2
  2⤵
  PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,14510316732234165624,1091253900785815278,524288 --field-trial-handle=1996,i,16342177758420993073,2189089026919314613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,10520998430233671124,5994532273760225527,524288 --field-trial-handle=1996,i,16342177758420993073,2189089026919314613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5308,i,16080727813900392227,4258456553022317091,524288 --field-trial-handle=1996,i,16342177758420993073,2189089026919314613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,10650129131471639766,12616259144816710744,524288 --field-trial-handle=1996,i,16342177758420993073,2189089026919314613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5864,i,2691025716278347147,12352917025808903100,524288 --field-trial-handle=1996,i,16342177758420993073,2189089026919314613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:1828

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:176

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2196

C:\Users\Admin\Downloads\robuxsetupwizard.exe
"C:\Users\Admin\Downloads\robuxsetupwizard.exe"
1⤵
- Executes dropped EXE
PID:4356

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\robuxsetupwizard.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1684

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\robuxsetupwizard.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:644

C:\Users\Admin\Downloads\robuxsetupwizard.exe
"C:\Users\Admin\Downloads\robuxsetupwizard.exe"
1⤵
- Executes dropped EXE
PID:3204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d42b9c28a144b6c721a4e981477978b9c24c1aa8656742cb57ac058dfdc13c18
MD5 0be5c8c1460ae3f9f870e1a60ad2f9f6
SHA1 1b8f7096c3f00259236e71b7165814d399b93175
SHA512 2ebfcfc9e327efd5e8689fd526d183d72bf79786df049a36b1c7b0cdf412839dc90529279fbb1bc6e5b6d6aa89c9499d63398a0a88fac99503ff974be7b8f32a
TLSH
T16CE0ABA9CC21EC270CFC872C10404705EA20131727A0841B3B3D810C8FB0667058289C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b1817001dc25c6739fb8c2ae7c9fe9a854526319224c2cd3c7f67552d46f6aef
MD5 91fd22069adce0ca63d09e74c968b8e5
SHA1 a8bb68e1f4fc0acde25386e8aa7d7a0dc1aaa715
SHA512 3a82706b3dc65481095e5c8c7304e0224b3b60c9f5891bb821022818745e4c975115c5fb2c0c0307e8f300751c742327fc21111c4a54318d16d18a846dc45974
TLSH
T164418DF783E4957E8A1192F4AB156E1FCE6D0924131C3C66C8D4AE1B97F2872E10078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6261a729452ffb2d89d74dcedadc0ed2b23058b8b4fb20db75a3d9674fb43528
MD5 9c6e9f428acdb7c4ffcf6ffa6faa393b
SHA1 812015f0cc904adb95840fe214782ead89c002a9
SHA512 192096741419351747308de10ba9713fb1a457a43983055d9e49c21983cdad6cb6c2378c98d49b421ace17c24788a8a861e091df3b304ca0d9b77617d0920b05
SSDEEP 192:IRAQIUOXHF86a+v7ApAPRp2l9qHsb+WNnlOPiTbcpZazMEx+VyIsnAUge:IRAQSU6kUXmkwcPUbQazX2e
TLSH
T15142A72EED106A3B9CDAC229FA257B63E7F5103520942E94DAFC892C25D75CC221711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 28524e1d9a69187ae15d345507f4a08f58a394c21ebe6af33d8079b25c9b89f6
MD5 0a436ca5fded9c6affdbcdbb1cd4a87d
SHA1 3f452f7feb84e9defd5837b77cc9b7711ea1482b
SHA512 85968dd9cba2c3e9074ee6e02d4d37b4bdf9495f5c45453bb2c6c5343a1c2758e994b55ae690cddcd36817ad147ce38a1a81511fd7a438c8f6f7054604d0d5d1
TLSH
T1BDB0124080016642D01303F81786248871D49F34960A2F0143E06932C8365548019150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a61e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a61e.TMP
Size 96B
SHA256 c8a399811a6ea7958db83f7efc2e5389f68cb4f3844cc54b614f58bf51ae9e0a
MD5 35fd0ec746a1084b8336edbf16eae6cd
SHA1 2fc24c1b24284eafef36580007e45614c7052b1b
SHA512 a734b5cd78f49a6cfaa0ab7003124caa5e09e3c188fb7243ee49583bec819e2487d0d217acf7e54bb59df5bd8b9ed05a35c0a4e0353f244ccda8be84b02d9e32
TLSH
T1A4B02280C0022302E02203B02A88A2C83030EF3BC3030202E2E00E23CC302300220820
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 047326ae7899099903fc880d3e27ae71f51c4b8cc0cd9349e1769ceecdd327f7
MD5 9246e47235c1029fc43005410eb71996
SHA1 e16e876ac744a4a3c0e6cbe3a3119d3a058bfa0f
SHA512 763cd2a452a9341c4b36ad9be40ff540a7613b294a7590350fb51fe512c74105d9d151ecbd0cb0f33110f03c01ed7e0fd368ffe853e6eca80caf1ec5f08b6d08
SSDEEP 3072:AWGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:im7Rkm1tYpBeh2BAog
TLSH
T198C3023B5D75E93B5CB5A74EB08E0F1E2EF249A6C920DE92C8D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 9587388b23556f69fb96d812980554c6944b57b2d35283ae3b97f5b56db6e89a
MD5 9fea39dbeda8fe51d55d378bd157c92e
SHA1 769587e5a15e651a98d36bfa06df636cc0724b5d
SHA512 bf90d47c445bfd3abd8d64ccbfe10141b2745bfdf4ca78e4f6d986c99b77273219cace549d57fb53bd55bd9f0da55d289c238fd9615406e9f572a65919aa8d3e
SSDEEP 3072:yaGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:am7Rkm1tYpBeh2BAog
TLSH
T154C3023B5D74A83B59B5BB0FA04E0A1F2EF249A7C920DE52C8D85A0437F97CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 eb0b4d4eed19e2391830b8b1ea67767923ae212d4464b51e40d02174df77ee40
MD5 8d3d45d2615e3b62f8ce021fba7e5e95
SHA1 b2b0076fc0612d163a232c5a661a417e9767b175
SHA512 23ea5fa879248b06f71bdf0871c0aa2bfbb18b8c421104693afee8a1221b7cff70a80fca96a4ce4423b21179bc12d24d599f2a3b650ed4f3c9b081acbec82576
SSDEEP 3072:yMGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Em7Rkm1tYpBeh2BAog
TLSH
T1DBC3123B5DB4E8375DB5B71EA04E0A1F1EF249A7C920DE92C8D45B0437E9BCD0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d105193081074754ccd5bdf648d2c018558c2ba3ec273f606270a94348cd7353
MD5 70f625ea95b3b29a5f4e05151bd623e2
SHA1 4682260059fe3f8361bea158a083d3233a08f2dd
SHA512 68629c88925869da4354408a5547738919699951b6199b711a712ce1a7e8a9762f9bed2ba089347749270d6ad4061aa447f69878a536e016707b648a7da2f947
SSDEEP 3072:rMGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:7m7Rkm1tYpBeh2BAog
TLSH
T1E4C3123B5DB4E8375DB5A71EA08E0B1F1EF249A7C920DE92C8D45B0437E97CD0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 92758.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 92758.crdownload
Size 133KB
SHA256 4e2160c7ec16c3911fe18efba69cb88684e2ee3f420a6bf35dcd24b7887f8fc2
MD5 b39a01efd24987625dc6b27ec4180ec0
SHA1 c7f33c2ff7cf57fa427d4f6159461199001541cb
SHA512 7b20aaebd3769db88b7c3f1ec7a960cb9723c5533b49c8c436e08d0be280af897b3e46222565296d1420846125392cdf7eefec15a0baef78512b18f14d325b87
SSDEEP 1536:SdoGiZiUTnWLPaizoJcNiGg4xTQfC2rMa0PLJduQ0VsBj9dWK27cDql5RL4AcwGq:SWGipyB06NiKxGB7wqlmSl
TLSH
T10FD319C6BFC99CEBDA56123488A743292339EBC58BC647134C3972350E136D0AED775A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3204-125-0x00007FF7C7ED0000-0x00007FF7C7EF4000-memory.dmp

Download

memory/4356-77-0x00007FF7C7ED0000-0x00007FF7C7EF4000-memory.dmp

Download