hxxps://roblox[.]com[.]ug/games/77182599101794/4nn1s-Place?privateServerLinkCode=02730099258389940037869141605735

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
14/08/2026, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://roblox.com.ug/games/77182599101794/4nn1s-Place?privateServerLinkCode=02730099258389940037869141605735
Sample260814-cet7csswby

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2796	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311464060812393"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-125073035-2952146151-721812867-1000\{2F7F2C38-3F5E-452F-8684-847EF6CC13C0}	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1900	chrome.exe
1900	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe
Token: SeShutdownPrivilege	1884	chrome.exe
Token: SeCreatePagefilePrivilege	1884	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe
1884	chrome.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 3244	1884	chrome.exe	80
PID 1884 wrote to memory of 5004	1884	chrome.exe	81
PID 1884 wrote to memory of 5004	1884	chrome.exe	81
PID 1884 wrote to memory of 2796	1884	chrome.exe	82
PID 1884 wrote to memory of 3464	1884	chrome.exe	83
PID 1884 wrote to memory of 3464	1884	chrome.exe	83
PID 1884 wrote to memory of 596	1884	chrome.exe	84
PID 1884 wrote to memory of 596	1884	chrome.exe	84
PID 1884 wrote to memory of 4384	1884	chrome.exe	85
PID 1884 wrote to memory of 4384	1884	chrome.exe	85
PID 1884 wrote to memory of 4764	1884	chrome.exe	86
PID 1884 wrote to memory of 4764	1884	chrome.exe	86
PID 1884 wrote to memory of 3344	1884	chrome.exe	89
PID 1884 wrote to memory of 820	1884	chrome.exe	91
PID 1884 wrote to memory of 820	1884	chrome.exe	91
PID 1884 wrote to memory of 3676	1884	chrome.exe	92
PID 1884 wrote to memory of 1032	1884	chrome.exe	93
PID 1884 wrote to memory of 1172	1884	chrome.exe	94
PID 1884 wrote to memory of 2816	1884	chrome.exe	95
PID 1884 wrote to memory of 3272	1884	chrome.exe	96
PID 1884 wrote to memory of 2816	1884	chrome.exe	95
PID 1884 wrote to memory of 3532	1884	chrome.exe	97
PID 1884 wrote to memory of 3532	1884	chrome.exe	97
PID 1884 wrote to memory of 1900	1884	chrome.exe	98

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://roblox.com.ug/games/77182599101794/4nn1s-Place?privateServerLinkCode=02730099258389940037869141605735
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf73bc728,0x7ffbf73bc734,0x7ffbf73bc740
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,10999653154787996716,4872579933348526626,262144 --field-trial-handle=1832,i,5330829720055629880,12853951803955495597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1824 /prefetch:2
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,4805452572826829045,4619384185909814812,524288 --field-trial-handle=1832,i,5330829720055629880,12853951803955495597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2240 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,14204902137009110336,8933221255027972570,524288 --field-trial-handle=1832,i,5330829720055629880,12853951803955495597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2380 /prefetch:13
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3120,i,15110908276153983766,9369698903770406568,2097152 --field-trial-handle=1832,i,5330829720055629880,12853951803955495597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3124,i,16284143923636112941,11877088111324820565,2097152 --field-trial-handle=1832,i,5330829720055629880,12853951803955495597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4280,i,17347057439538033405,10953831910448205232,2097152 --field-trial-handle=1832,i,5330829720055629880,12853951803955495597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4308 /prefetch:9
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,1285626468791936725,14294334221637626156,524288 --field-trial-handle=1832,i,5330829720055629880,12853951803955495597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5336 /prefetch:14
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5332,i,2660114959881189664,17029239599909993403,2097152 --field-trial-handle=1832,i,5330829720055629880,12853951803955495597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3364,i,6902690172860876004,1315571470296088175,524288 --field-trial-handle=1832,i,5330829720055629880,12853951803955495597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4492 /prefetch:14
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3360,i,5617011893119464305,12864062541100662531,524288 --field-trial-handle=1832,i,5330829720055629880,12853951803955495597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3396 /prefetch:14
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3416,i,3285832536970825887,15843369388842238904,524288 --field-trial-handle=1832,i,5330829720055629880,12853951803955495597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4572 /prefetch:14
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,9096250603495012161,7307094416402381144,524288 --field-trial-handle=1832,i,5330829720055629880,12853951803955495597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5748 /prefetch:12
  2⤵
  PID:2816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,16093512388948465811,11358183830322312972,524288 --field-trial-handle=1832,i,5330829720055629880,12853951803955495597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5664 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6016,i,15786143930450288264,7536577085668235728,2097152 --field-trial-handle=1832,i,5330829720055629880,12853951803955495597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6288,i,7909584353814788314,5967935889895929350,262144 --field-trial-handle=1832,i,5330829720055629880,12853951803955495597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6300 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1900

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 cf0aaca5711a61257ceef45599326f9584693b153198a0553404e6240cc05e47
MD5 a2c3ca5c734c279c396a1b538b017d12
SHA1 ad7acc71a75c5db15e18122a4d649383305cfcc3
SHA512 c2f8cc70268e9335e21dab0b905e7202e4b20ce3feebc0c62b2ebd80c94c6e2419958bc7a900f41ea36d086919a2b8987a49ed644f37a4cc6f0ddbe69765e523
TLSH
T15CE0E5E9C912AC271CF91B1820604606F7A013AB2E518A5F3E3C51188FB5736458A96C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00002c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002c
Size 41KB
SHA256 2d73eefd868f115745117f76888a9b0124453918522046796a55c3621ad2c15d
MD5 60df02cbc9b6a531c2d3cf32025a4dc8
SHA1 71ce31d6e0f59f98855a01b3eb9a37a86352189f
SHA512 cfc2d4bc147bc757054c07a7e347091922d4ff9b7a0f856d0a3c278f5a98fac1a539d05ea5c375868b372f006a530d14558ac7027723f83f3b22087bd12992dd
SSDEEP 768:xukYPFrf/S2LrwItWogYvYt+8GNUOvhc/st7yJR0M2+FAuuUsVpT/dEDzY4Ro/TY:xcfZL8ItW0YtJmVvK47yLt283JQ2DzYY
TLSH
T17513F1E998621410B0F35FF8A8BB89B551FF1E3D8EF955195D882507D76103829463EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000068
Size 20KB
SHA256 5af05f349cbf4bbc32e6014fbf3ae32745bfc7746de554da6141c2b6e7e9bc92
MD5 d1ba417a557040dc4ad2c26b8950124a
SHA1 54f9188c707c0735b4c1d2d69e078a63303d21d0
SHA512 fa3df12f81f4ad354572b176095f1223e11abc336ed611ac5d697dade1cb5b649d1a83d7febb623e3c041c9b14b41776ba11683fdb08e506d314de4bf50b3293
SSDEEP 384:l6E9xqCumxKDMYvwSpf23idkHxd+fWOupvC5sDaqZgGlFMYm1335hEKOb+vA2RC0:TqhroSE35gfWY5Q5lZmt53fvnR3
TLSH
T15BA2E2819A2B35F4DF75ED182FC01571ED52F6AA5F77E2D09474B1033ED98818B129C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 8fcce73a25130cfa9a19ead7ce428c9844d13a30a7d255f25e5e7b8bb8b1c5bc
MD5 c5c246dfd8406893f2eb390f0acc6ae1
SHA1 a55976c56ee4240811fc480608283d75492962f8
SHA512 5c9c76c3bdbcfa34dfe0b80e6c44f6e45215e4f0126a2914e38fc53b28fc31f47c976aa133bfb938ad07bee77b2c33bfdee7270532ee031d990748576898bc1f
SSDEEP 48:UZ0ZOyyVs3ShowwNVht/KHO0DXz+meb4cXF4FloWZYIGZ3lz/lTOPWh:Tihozj/MXz+34cXiFloCYIG9N/g+h
TLSH
T1C391D44387F4AF67DF402979658E8F843028185BB03A0B375E706D3528C37EA1BD14B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c3bf7e875797e8e55c88d7acac817544edf1373a18473cb603600e14fd60400b
MD5 6d72d20306655448663dffdc9a0cbaf5
SHA1 547b467cc771e33a486c55883905596bbbe8c70c
SHA512 333165715f50adb8ef48233d9cd9e15e87cf0cd1a6474d0557d928574bc173dcf971232e00d3598c7fbd68ad8a94c915dafe1f3e7837e2ea5e737c3ed778ac28
TLSH
T18C418547A6E5BF23CF443AB4368E8D457100180BB17E17735674BD3529C31DA2F914B4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 f17836bcfddf0c6a732d64cc29411c3673e2c23758dfecb4eb5fee35edad970d
MD5 399ca506f161c699273b9cb4267d421c
SHA1 836a5af214069931423ae1850bb260fa137113e3
SHA512 7c599df269abe66eba637cdbe0d8248ecf6d696596e536d2554eb23753925e5ca0f45952baacf4e58bca85f3d7e6ad7b944ad3e8800d4ebeb19b5035a883dd77
SSDEEP 48:zl0ZOyyVy33hoxwNVhYz/zHO0DXz+mW+tpcXF4FloWZDIGZ3lzulTOPWA7:wVhoCy6MXz+StpcXiFloCDIG9Nug+O
TLSH
T1DAA1E70387F5AF66DF412879659E8F8030281857B43A0B375E707C342AC37EA1BD14B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 d0a0018f2f3516417baa1a202a8bbd8cc8385c30995dc38c435560feb8a86021
MD5 fc12237a05a796e5a2f37d3d408a58b3
SHA1 68a9e6200f7a0aac87f8df7713a979b65110f906
SHA512 b1f72fe2a87dce807bd11cabd0dfc9fe2e6f4b4008484a307ae2dc6da320feec462b5475067f46c85b4dac39a79f9c260b4430b441d870465bfaa5ef7b42d3bc
SSDEEP 96:DHDaIaEd2QN1jfgx1YZMCX1kswOWV9ubB8:DHDaIaEd2QN1jfa1YZMCX1pwOWV9ubB8
TLSH
T1B8A16BF783B4D96E891196F8AA15AE1BCE5C0428131C7C76C9E0FE5753E35A2E20078F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 52fb958c7a651ec68531576b6c27449f41555f27c77cc1319a7998c4dd250689
MD5 f72d69932b20761f29589c5cf2e75fd3
SHA1 a365da125f15a8781b54b2216c45e88041a320c4
SHA512 b83355febb101eb31d33eb4153563a98fb7766fe536e9c248294fb6213e90ff5e01e50d9c3d613e1f85d82566a82c99691906f029293248064c4f21f8fc436ba
SSDEEP 192:4RLsZkZ5v2bVF7xy1Cyo6v7yp3KCPRp4Wf99Hsb+WNn+NrW1cbPALaj/G8yIsnAI:4RLsav2bVF7xy1CyoWmFRXZrwkwcWaNE
TLSH
T18352E52AAA507C3B5DDFE629F9117B13D7F5107529902E84EAFCC92C14E7ACC222B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 61a5b3fcba41a11577100e3cc99e4dc9aea6e49e0db0c4e203b690ca16314114
MD5 c6daf463b748f8ae782e175b09bd90a6
SHA1 f78442130027f32aedcec6c17d62ad5f11067f1c
SHA512 39133db89a1b29b37ff43ff214514fa9bcab6731311291f46b818662bb39685c8739063d948938053c401bb4f6d88894e1aea9997724e904e472eebc8cd45199
SSDEEP 192:4RLTFZkZ5v2bVF7xy1CyoUv7yp3KCPRp4Wf99Hsb+WNn+NrP8emPALaj/G8yIsnv:4RL5av2bVF7xy1CyoQmFRXZrwkgebaNE
TLSH
T15E52E62AAA106D3B5DDFE629F9117B13D7F5007629D51E84EAFCC92C14E79CC222B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6089e0c0ad8415458334a95aa081eb47e7e87d4ec800f452e09b2576fb5512a8
MD5 7af0884c2c48138a420c02173720aedf
SHA1 09ead56ccf5027a4c629d6fb4e101b3abc8f14c9
SHA512 9e281dc5cf8f874a7d41304d89f423735dbefea6c46319dff4e61f06bf7d1abb9add55813de192de4ca72dc2987be050334ad87e99c753ade0bde42c82076599
SSDEEP 192:4RLsZkZ5v2bVF7xy1Cyolv7dp3KTPRp2WC99Hsb+WNn+NrDw21PALaj/fVyIsnAC:4RLsav2bVF7xy1CyoVZFKX6rwko2Aa1e
TLSH
T16842D42EBA50783B5CDBD22AFA157B13D7F5106528D52E84EAFCC92C14E79CC222B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 559e3fcb96469a08ee96a20c19cebd46335388c77bf3d9c5fe62170f1613e6f7
MD5 b1b77f53e7d97e9beab2edc7c987152c
SHA1 6c22dae9751d3b4d3e6d12035aa8cf7f7497bdfd
SHA512 e528b9ee5e29bb9932a71039dfa371417055f399d43d40cfa24caff2fb1ce5bcaaa35ea0fbdd6d5c9c7332a2ba1a31be54e59d50722fac99c97e4fa9dec87187
SSDEEP 192:4RLsZkZ5v2bVF7xy1CyoUv7dpAPRp2F99Hsb+WNn+NPiPALaj/fVyIsnAUge:4RLsav2bVF7xy1CyoQZUXKrwkPXa1e
TLSH
T1AF42D52EAA50783B5DDFD22AFA117B43D7F5106524D42E84EAFCC92C14E79CC222B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7f10eec20a7ddd45697e8b011fd30035ff04855f17e4323366b484e12d5d2408
MD5 5aa719f2940439fa6f9d1662eaa1f640
SHA1 47e9dc52eb77418a9a4e746ed5029eae3185ce74
SHA512 d3f080a4650ece06c6b8187fdd3a89cb800223fd991e4a465f39aa90a46836b755fe8381690770ca5c1944746c2c891c7dfeb8db621d45844d0f78249eb0f556
SSDEEP 192:4RLsZkZ5v2bVF7xy1CyoJv7dp3KAPRp2WC99Hsb+WNn+Nr8jejPALaj/iVyIsnAI:4RLsav2bVF7xy1CyoJZFHX6rwkoeOa+E
TLSH
T19552D52ABA50783B5DDFD22AF9117B13E7F1106528C51E80EAFCC92C14E79CC222B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 13ca746075226c1f2beb2a371f9704fb7ba71f247bc346f51655438c0e6ce105
MD5 61591868220fe7bce1ea9d7d1859f41c
SHA1 64a514e9ad51f9adb5896722cb8b79b7dab14efb
SHA512 737565abfe8c97038eeea37d3327cbfa9f82887393d9c28186a0fbdbb5641ca515d4bb0b54d9ed949cc2ab10c0b7e479c513d17f33954b5f146a407b2e46a1c3
SSDEEP 384:4RLm0av2bVF7xy1CyoXmFRXurwkgebaNE:2m0av2bVF7xy1Cyo2CrwkOa
TLSH
T14462E72EA9106D375DDBD229FA657F23D7F500A62A841E84EAFCC92C04E79DC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 03170d42c983422ed1e6963c474bc6b817c3c6ff85560ec2e1316da747d6ef34
MD5 7ba0278f031532f998b96309abf9ad76
SHA1 e3fd8959de4f1421987f0cf2b5159be06b5d3b57
SHA512 f45d049a91bac75717589097004197fd3b33b7ca9c1beeca04d36e4359b4963f6efd7a64c2f925ce07af29e60c9a4e0887774c1394f3f1030835f51a2be1ab17
SSDEEP 384:4RLe5av2bVF7xy1CyoQmFRXurwkgebaNE:2e5av2bVF7xy1CyojCrwkOa
TLSH
T17362E72EAA1079375DDBD629FA657F23D7F500A629841E84DAFCC92C04E79CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 86a708718cf15f4439caa697f6058448e2b7016cb1cef9cd2e54315587d87208
MD5 c23047ed70b8fe98404f2d539506eb71
SHA1 777411f14fab3beefe67a6f475f14f7e6e56c013
SHA512 0a47725dfc0cd3a51a0c13fc01329dccf73a0e6fe775075f027ab629f4c8fde68db8b61d4cd2ce4269a02632bafb0dcbc043ec6377186b9c4b1d39ea91b3d0ec
SSDEEP 384:8mjoj7KxkXqKf/pUZNCgVLH2HfgslTg97pLuLcSjuvXODof+ErU3i4JHGtovIld:8Goj7KxkXqKf/pUZNCgVLH2HfgsZg97V
TLSH
T1C77208676C4C9E370F94CACCD8167B4F9DB5014B65EE886483FA982903D5BDB110A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 1ddfc8cfc8b90ca16a192e67de3b3f9b644dfcf73f3da8e8eaab3c02df10faa5
MD5 62b5b9639a381b21a67ec4670677d13b
SHA1 7d4b1952e5fb1640a792639ea0e305b095a80e49
SHA512 0fb47fc6f7be7e10a90a63391fa078f237bb9f7d0b69858ea8cd9aa71510ed5151015f5d5dfa11523010b8991acc55fc0ed42d1069701df723e52cec44bc395a
TLSH
T1E8B0120180815252C04202B42546249871189F18960F170553E07A23C825671C118051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d55c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d55c.TMP
Size 96B
SHA256 2e68274e248f8c7ce153f132a256b03ddd6106896536a74ffc61f369feff0b16
MD5 c2c21f0cdb4ffc81f67b7035d03d23e6
SHA1 5858c9fd1a1b33aab628b4706d62fb3d78efa12b
SHA512 58853e4281ec7e9ef013f43a0253fdebf0bb54a0b7a23a38a9f43e8a0ec63056050fce07a1c08e2f066a061535f7c63e8e742ddc928eaf067cb47a82d9df9e6f
TLSH
T13BB00255C2036322C14313F1759D99F8B261DF79C74313729AE01A76DC256B98765171
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 72dda203374bb9596d5db158e3504188612399dcfa8b053562c35069da1eda8c
MD5 9382d35758b7ea89ba742aa1fd906a32
SHA1 85f43940894351f598b410b83cb63748fbb4d61c
SHA512 13e1348363ccc97afd7759cbfe070ea02f5945bc6516c9a8aab43745b01d9c3a3f612fa4ea7d0fdaaf6c13c59724b9bc97b7bb18c24d6d635beb5fad5e1bf1a9
SSDEEP 3072:mtGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:mkm7Rkm1tYpBeh2BAoi
TLSH
T131C312375EB4E8365DB9BB1EB04E0A1F1EF149A6CD20DE52C8D85A0423EA7CC1A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d928cc8523feb1ca8dc916be535405362dbbd860700b226a5dce054568cefb8b
MD5 0c462bb4213c619fb031185d8df78071
SHA1 aa8f4f94f6ee2c2beb4ad8225596efd8457b9889
SHA512 b57396559cc6983c2d48e0b6dc144d09063c470086fe9ae7d3403670ca67a512da862572858fd7b586681e55a35d81bfafc5e574d1de90afb06e26ab5420f220
SSDEEP 3072:1tGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:1km7Rkm1tYpBeh2BAoi
TLSH
T167C312375EB4E8365DB9BB1EB04E0A1F1EF14DA6CD20DE52C8D45A0463EA7CC1A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 117e00dcf9e51293c1ca77baaac45cf3e2c901754fadc8c0e0c7405022aa6cce
MD5 276a429d01fbbe1cb4a553d8454d3f22
SHA1 98c0b25bd0d11a2eee46e1b27ac0f7eb21caeff0
SHA512 197b4dfd20bca1c222e15ed8c98dadd666c820db67cd05d07ad90e7dc9c31fca14574766402953221978fed3326c938bd9b643f65b5171ac527d0f4d1e1fa4c0
SSDEEP 3072:TGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:qm7Rkm1tYpBeh2BAoi
TLSH
T1E1C312375E70E9365D79AB0EB48E0B1F2EF149A6C820DE92C8D85A0437E97CC1A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 abbd242dd1d13df49bc2864e5eed26032837740561408e91837c6467fe3b4b8d
MD5 f115bf07711e504f59efc46db4328be7
SHA1 39f6eb791415f9736ddabb4fb7240de68c24da05
SHA512 c396515db1db5e6446b5797ea778b61b31f16989433739813299b983046bfa249c271115cdf63dcc459847d51864a27ea9e278758fe48bae42c4f9e7249b79b1
SSDEEP 3072:m3Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:m2m7Rkm1tYpBeh2BAoi
TLSH
T17CC312379D74A83B5DB9BB1EB04E0E1F1EF149A6DD24EE52C8D85A0423E97CC0A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 3905f637bcf358438f137cf17377e4d56b477851c5950dadaa25c5a37e5610bc
MD5 40681eab23af5fe7859759cbae5a79c8
SHA1 9b32a029d827ee7d9f1bd5081147ddbda855bb87
SHA512 ccec71a28f263209f64ea2fe7746c29e58bdc320cf45749f67ab32d4815f0ed716c9d4ad9eb58e0a81455ababacb5492327ec22ed490286422ebe4b9bb0336cb
SSDEEP 3072:53Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:52m7Rkm1tYpBeh2BAoi
TLSH
T13EC302375E74A83B5DB9BB1EB04E0E1F1EF149A6CD24EE52C8D85A0423E97CC1A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download