a03c9e508261bead967f561dff1b4122e1e1b5baa6a7eaea15fa4aae75ba75fa

Analysis

user interaction
yes
max time kernel
129s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
REBOOTEDSPOOFER.exe
Size 36.6MB
Sample260910-c2p6xsthnd
SHA256 a03c9e508261bead967f561dff1b4122e1e1b5baa6a7eaea15fa4aae75ba75fa
MD5 04b015c49535a8cf0793b84ea0d31af5
SHA1 ee1e0de38ff378ab64c1fd3245e5b39d3437ba56
SHA512 6d08db4ddfd49b5299d2500976ce8b411d5b0e4db0cd7537dfa507c64200cd32a9547bd714f18e4916a7bcf56271a5935c062d963795ab8cac62eb1845996260
SSDEEP 786432:7fUmjzIK2RhCcj9gsK3pMG0Wt7tDCr5nom5Yee/L9EsLY7Oz:7ftjcbccjrKyGd9tDA5nom+DLdLn
TLSH
T1C88723EF81A6B2ADC0C24704668E50C775D0B4BDC5FE962D2DCB5C43B468D6AC68CB72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3672	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334813661660391"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
836	Process not Found
836	Process not Found
836	Process not Found
836	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe
Token: SeShutdownPrivilege	4828	chrome.exe
Token: SeCreatePagefilePrivilege	4828	chrome.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe
4828	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4572	4828	chrome.exe	95
PID 4828 wrote to memory of 3592	4828	chrome.exe	96
PID 4828 wrote to memory of 3672	4828	chrome.exe	97
PID 4828 wrote to memory of 3592	4828	chrome.exe	96
PID 4828 wrote to memory of 4764	4828	chrome.exe	99
PID 4828 wrote to memory of 4764	4828	chrome.exe	99
PID 4828 wrote to memory of 3396	4828	chrome.exe	100
PID 4828 wrote to memory of 3396	4828	chrome.exe	100
PID 4828 wrote to memory of 2316	4828	chrome.exe	101
PID 4828 wrote to memory of 2316	4828	chrome.exe	101
PID 4828 wrote to memory of 2260	4828	chrome.exe	102
PID 4828 wrote to memory of 2260	4828	chrome.exe	102
PID 4828 wrote to memory of 3400	4828	chrome.exe	103
PID 4828 wrote to memory of 5880	4828	chrome.exe	104
PID 4828 wrote to memory of 5880	4828	chrome.exe	104
PID 4828 wrote to memory of 6140	4828	chrome.exe	105
PID 4828 wrote to memory of 6140	4828	chrome.exe	105
PID 4828 wrote to memory of 5972	4828	chrome.exe	110
PID 4828 wrote to memory of 3736	4828	chrome.exe	109
PID 4828 wrote to memory of 5972	4828	chrome.exe	110
PID 4828 wrote to memory of 3736	4828	chrome.exe	109
PID 4828 wrote to memory of 236	4828	chrome.exe	112
PID 4828 wrote to memory of 5704	4828	chrome.exe	111
PID 4828 wrote to memory of 236	4828	chrome.exe	112
PID 4828 wrote to memory of 5704	4828	chrome.exe	111
PID 4828 wrote to memory of 2204	4828	chrome.exe	113
PID 4828 wrote to memory of 2204	4828	chrome.exe	113
PID 4828 wrote to memory of 4556	4828	chrome.exe	114
PID 4828 wrote to memory of 4564	4828	chrome.exe	115
PID 4828 wrote to memory of 4556	4828	chrome.exe	114
PID 4828 wrote to memory of 4564	4828	chrome.exe	115
PID 4828 wrote to memory of 1400	4828	chrome.exe	116
PID 4828 wrote to memory of 1400	4828	chrome.exe	116
PID 4828 wrote to memory of 5988	4828	chrome.exe	117
PID 4828 wrote to memory of 5988	4828	chrome.exe	117
PID 4828 wrote to memory of 4140	4828	chrome.exe	118
PID 4828 wrote to memory of 4140	4828	chrome.exe	118
PID 4828 wrote to memory of 6100	4828	chrome.exe	119
PID 4828 wrote to memory of 6100	4828	chrome.exe	119
PID 4828 wrote to memory of 1376	4828	chrome.exe	120
PID 4828 wrote to memory of 1376	4828	chrome.exe	120
PID 4828 wrote to memory of 3192	4828	chrome.exe	121
PID 4828 wrote to memory of 3192	4828	chrome.exe	121
PID 4828 wrote to memory of 1348	4828	chrome.exe	122
PID 4828 wrote to memory of 1348	4828	chrome.exe	122
PID 4828 wrote to memory of 3436	4828	chrome.exe	123
PID 4828 wrote to memory of 3436	4828	chrome.exe	123
PID 4828 wrote to memory of 3416	4828	chrome.exe	124
PID 4828 wrote to memory of 3416	4828	chrome.exe	124
PID 4828 wrote to memory of 5964	4828	chrome.exe	125
PID 4828 wrote to memory of 6100	4828	chrome.exe	126
PID 4828 wrote to memory of 5964	4828	chrome.exe	125
PID 4828 wrote to memory of 6100	4828	chrome.exe	126
PID 4828 wrote to memory of 1180	4828	chrome.exe	127
PID 4828 wrote to memory of 1180	4828	chrome.exe	127
PID 4828 wrote to memory of 4280	4828	chrome.exe	128
PID 4828 wrote to memory of 4280	4828	chrome.exe	128
PID 4828 wrote to memory of 4324	4828	chrome.exe	129
PID 4828 wrote to memory of 4324	4828	chrome.exe	129
PID 4828 wrote to memory of 3080	4828	chrome.exe	130
PID 4828 wrote to memory of 6120	4828	chrome.exe	131
PID 4828 wrote to memory of 2104	4828	chrome.exe	132
PID 4828 wrote to memory of 4320	4828	chrome.exe	133
PID 4828 wrote to memory of 4320	4828	chrome.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\REBOOTEDSPOOFER.exe
"C:\Users\Admin\AppData\Local\Temp\REBOOTEDSPOOFER.exe"
1⤵
PID:1756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd8bfec728,0x7ffd8bfec734,0x7ffd8bfec740
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,5727815161166692863,17591261650294671025,262144 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2016,i,17971167726544144671,16320234821538622461,524288 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,16421991808712910734,14625968942015311027,524288 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:13
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,4176539084385025883,4216481422917544046,2097152 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,8630424403806587082,10620051664448521501,2097152 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4692,i,944346305484524890,5169896949665939911,2097152 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,1843340709285438079,6947493655699173940,524288 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5468,i,17793420388663343836,17825300504780084208,2097152 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5536,i,6636743343398149484,13660247502212971214,2097152 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5512,i,17516907202272752722,13429153315280620076,2097152 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5868,i,9477491858150256748,15614661753718358373,2097152 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5640,i,6728556232059970475,17518147676086366107,2097152 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6084,i,12189462848802329435,15062027070064126482,2097152 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6100,i,9814096103445758215,2651427427320483194,2097152 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6160,i,15121161559514136403,4433761309155544801,2097152 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6128,i,12417767342637319688,4972021833383306086,2097152 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6188,i,2642120990216568721,839515040640827359,2097152 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5780,i,15126559358500202985,5830763796452806012,2097152 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3952,i,3653035584631489280,8933267710818143502,2097152 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5832,i,247322692563994193,17751350725937196662,2097152 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6216,i,8046488796191119029,10073925209259532974,2097152 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,11445834486820565677,12299605710648880023,524288 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,3038153873501936167,11853021972877439538,524288 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:14
  2⤵
  PID:1348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5636,i,3897557059208922341,4372202327032036230,524288 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:14
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3688,i,3272671598271075745,18165034095027552055,524288 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=4684,i,15313724226656953741,5375785141345178365,2097152 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:9
  2⤵
  PID:5964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3652,i,6556366493263340986,14135362791155533021,2097152 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5720,i,10408505966541676551,7068611673191894750,2097152 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=3728,i,10735497692004306643,2037263255310716816,2097152 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=3564,i,9674690124018715716,10836324739725214234,2097152 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4816,i,3924863212412937727,14273653600637391255,524288 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:14
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6732,i,6432781576897285738,13691721918987552415,524288 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6308,i,9946156581084373750,6022198615559910050,524288 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=5788,i,17360806958442133364,17636114960208055062,2097152 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=3652,i,17186679502414702344,10049769490033777090,2097152 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4736,i,12148095309116162136,13506064392030228656,524288 --field-trial-handle=1880,i,13080573825032934974,4778607307100580588,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
  2⤵
  PID:4292

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5332

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1180

C:\Users\Admin\AppData\Local\Temp\a98edf00-2c57-452e-a924-dd57e3a8d711_free robux.zip.711\free robux\troglodyte1.1.exe
"C:\Users\Admin\AppData\Local\Temp\a98edf00-2c57-452e-a924-dd57e3a8d711_free robux.zip.711\free robux\troglodyte1.1.exe"
1⤵
PID:3352

C:\Users\Admin\AppData\Local\Temp\d26bc2d4-a6a8-4daf-9960-4d8c83cb7345_free robux.zip.345\free robux\troglodyte1.1.exe
"C:\Users\Admin\AppData\Local\Temp\d26bc2d4-a6a8-4daf-9960-4d8c83cb7345_free robux.zip.345\free robux\troglodyte1.1.exe"
1⤵
PID:2864

C:\Users\Admin\AppData\Local\Temp\5c08250e-39da-46bb-8a86-164dad30c640_free robux.zip.640\free robux\troglodyte1.1.exe
"C:\Users\Admin\AppData\Local\Temp\5c08250e-39da-46bb-8a86-164dad30c640_free robux.zip.640\free robux\troglodyte1.1.exe"
1⤵
PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2d47ac41-3396-4cb6-8140-8095bbe75851.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2d47ac41-3396-4cb6-8140-8095bbe75851.tmp
Size 11KB
SHA256 48cbcc88875a7e40f96f5d34c4b47658bad92859246ba43e3509fc84d9a873d6
MD5 3f09074df2208ff0b0fb67eb67589e3d
SHA1 f444901a792b995ca0e4dc3f3e77449b6b15f7f4
SHA512 b4b506ccc7962e7b505271459f0c8ee556d2d7f0743cfe7d1462e6df75110546d1d9288138a978d17f1ab763803edd941d6e39ebcca28b5ca8491f950b297943
SSDEEP 192:e5a4K6R97KxkXqK4I40pUZNCgVLHrKHfFKslE8/1XzKD/ed+ErUkKNdrtumtK7rx:Majm97KxkXqKf/pUZNCgVLH2HfgslN1N
TLSH
T12E32D827A48D9E7F0FD8D518CC136F8B6CF5429262780D2896FB9D0803A578E114A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000020

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020
Size 109KB
SHA256 08f7d2a3d8c66abbf765adcb009c87efbd44d9a2cb84222a9b242993bc714b61
MD5 8b956b2c01c91121b894e461dd2762a9
SHA1 42755317f8376463e2b60139ecffab73140d8398
SHA512 4d3eae413bc3d2da9246f220f45f6c76751039f69e1d25829baf4853acbbd73106e8bb8d8b10a65db7ff85c05a622d1ef44bce7fa8ff8f5edb0c0bcb4e642efa
SSDEEP 3072:SBMFhQtQZg2e0CkaOaaFEQ02Vtfizg+uyKt9npdz:RhQtCg2e7kafwpFVUggY9pdz
TLSH
T165B312BD5FF171072DAFBCA66BB8880459E1318819A309432C5D78C3AD2CF6D54A2B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 e3ed3a61c7cb5443d7ef77635a079259d5a8a75fcf0dbb363a4fb96761a139f9
MD5 4bac41bbf301117f29fbde440622fd8c
SHA1 25a5eae20e325aaf2b45161d59bc3a4a34744abc
SHA512 e55e5f9ca4de997f4d2c9d7db4d3b8801b979f146a72eb1cb899d549129f7585c20d88fff55eafb2aca0203eb99d67a02369317e24403c4e37e130b59963461f
TLSH
T1CF311E82E452A037DBA30B33AAD2D2F375345189075A0E3A467DC834B94DBF3A18C924
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 739ac5673e42e56e4926659eb83615131cdeb653481bcee4431723c8773324cd
MD5 59a29005684eb75e03953c3bdfd26051
SHA1 f25198563d0ff1974d780769e3a31d3177906f89
SHA512 1157310fd200d2a69db02920589a7a094e4175a86f42f2fbe30a610f9047f950f8d870a836f9e08ba0ef89c0a84ffadf18c2b6b8aef04f0ee2827bba10012e09
SSDEEP 384:DcN6az/uoH87kCeA7vDRg7+HSIwEv41bNFIYIqqT7CNVrzY3GwSk7RXbeC+tiNjc:eGriW2vh3
TLSH
T1AB92CFF3C3E8DA2DCD6155F1AB152E1ACE590A1443183D6BC8E9FE5B63D2471E20268F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b8d2221990182896d8036bd43c1ef920a618950c808b6ec466fc047f69311646
MD5 26858e7de34ddf94fdceeed11faf604a
SHA1 b8f3aad4594221aeb53ff4ff7e19b75b908abfa8
SHA512 c24e639c4e5e857108bad29dfdf9f323b183c7cf8d15a632368dd331a9727ef88bb9a628d7d758b8220fcf2a9af3416441ddd53f1a58f51735b2d08172545f7a
SSDEEP 192:AuR5cB10qjpv7haPRpCyTXmIX98Hsb+WN1nyFoaRGu+vmG2ETJkq+f6VyIsnAUgE:AuR5m10IpKXzuwYZm2eJu6E
TLSH
T14E52B56AB92079BB6DCBC31AF9217756E3F1112164D42E84FBFC8A6C14E7ADC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bc84c24b5d7807d0b209f6863109296df3d38eced2355f42471ae00bad778653
MD5 6a9e742cecbe70835b675dcc3ccb7d12
SHA1 c4e51c3ab18287cf573d56e0b8ab46c4b0499b8f
SHA512 bbcddd126e08f68425594c74527b02ccd3b73cb8b14087098cf9a758f199c0fdc3e3a4c8b5e5efe36f2322f7156b6e7393fa2e19c23ca6546c3e7e2c52987188
SSDEEP 192:AuR5cB1qqj6v7hAPRp2yTXmIX98Hsb+WN1nyFoaRSoj+vmG2XqTJkq+16VyIsnAI:AuR5m1qIWAXnuwYFm2EJS6E
TLSH
T12152A46AB9207DBB6DCBC21AF9217756E3F1112164D42E84FBFC8A6C14E7ADC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fd3783371fa9848a5888be05e9b3eb7a403d9f26d8b20ec205bbbca6cd99f46e
MD5 c6f7c2c8e9c78d67a1c5c204aa55df61
SHA1 41ad916f3b0f19ea83d4a921cdabff671e1891ea
SHA512 9dfcdd456c4aad5f2aa77a62c8e3623ff4d890f858bbbc9993949894d96c82bae623c13b7c661bb58e5943ac0163af79545e7ef1bab5582bc5920fa9d415c320
SSDEEP 192:AuR5cBzqCjUv7hAPRp2GXx98Hsb+WNnFoa7vmG2svTJkq+F6VyIsnAUge:AuR5mzqgQAX1uw3X28JW6e
TLSH
T14042C62ABA1579BB6CCBC21AF9227757E7F5112124D42E84F7FC896C14E79CC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ce1ab64b2b3c2b00aace9ed33b2e75873d5566a0dfe16f16c02c128c4d7da72a
MD5 114c51098987ef301cb3abb2154119ca
SHA1 23cace55b626111f0a54b3458ec12a3f2ac1edd7
SHA512 ccb0434c90fae9a712f7a32a9912586f323d9e0e49a76f88123404b944c53387d59dd2d170c977f2148cf995c925ef3dda5b89607f11bf57f90e65523b3a78bf
SSDEEP 192:AuR5cB1qCjUv7hAPRp2yTXm/X98Hsb+WN1nyFoa7vmG2svTJkq+F6VyIsnAUge:AuR5m1qgQAX6uwYX28JW6e
TLSH
T16C52942ABA2079BB6DCBC21AF9217757E3F5112164D42E84FBFC896C14E79DC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b0bc2494a546a3d669e1ec744583cc16bcb3db286665e400185e99fbf85cfca0
MD5 f9290cd6c93a74ef870086ef6958c185
SHA1 535ef40f7f3d60f2a66aaa42185fca3105a8121b
SHA512 d96a831683a074522d223190f350657c2a8d8db6cf24231973f0919d4b2e344e426e684e855b49b8ebd3679358f77b0356f6cb17ea8c355f7f85cd583b9cadbf
SSDEEP 192:AuR5cB1qqjav7hAPRp2yTXm/X98Hsb+WN1nyFoa7vmG2sYTJkq+16VyIsnAUgE:AuR5m1qI2AX6uwYX2DJS6E
TLSH
T11552942AB92079BB6DCBC21AF9217757E3F5112164D42E84FBFC8A6C14E7ADC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 9176937cbfb42763bac3a5d495be153f6098599ceb2c5cad17ce762de1632e38
MD5 f88afce938dd1c93603c10bd47570c39
SHA1 d94ebde095ad5935d74f74024a275a2e2889b9e1
SHA512 5f456841d29de562b8e8b24607c92958f27d410569990ca7f37e7d0663c021f5600d7e6f070319d6f8ab2915c9bcb684e34eeaca7acf21c7809dbcf1a22930db
TLSH
T1D6B024D400D04F01CC40CF3743D110C033003C1503037743C0404005D7055C3551D3CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 2ff4784c537b8aefb50382153e964fdc4ee422ca89cf4e402ba6472955b58bc7
MD5 04ec83650464b1b9a0d71230927d99c7
SHA1 6810585c5e9767631927f2d9ec52af1b09cadfa7
SHA512 27b302500ff3fc03b69101efa1f89bc182b5579539aeab329ede4151595eacdf01f556ecbafb6fa9d97f1403078b7de4d58299907f66af73d677aa06068d5849
TLSH
T136A00254C3D08871DD158376676605513252CA141591634354969944DD5F2D4C512A10
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a8d5d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a8d5d.TMP
Size 48B
SHA256 6ae5d25c42b6d58b8ddb468df0e397d15b672052acf4c4706e333969ae36c90e
MD5 7b53645523904278ccab29af2258577b
SHA1 52ed096856a6cca1ed6ae1c92bd78d22ad718746
SHA512 2def4df363d17671828fc777e603ce4638f1e1fbc5f2457d392b6d0edbf86048afa58695171b59e347f560fa632df57ed8ce24f47abfaf6eab6046e0c8e1f0e3
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 a9826f19f51d9c7ac67c203de577a4dd24c8c3292e81b0d7b9594483476d52e0
MD5 5021a467225afa0662346d53f809caec
SHA1 997e48b64bbb2098420d1c9330817ac8516d6e77
SHA512 98d0f76b2d52fb6a802427e625dfe27702eae5d7555097fc70c17f38f184451b37995eb2850359d8346c1b7ed9e25f0741cd5c7eb1e0333a0ac842a69419f433
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5THDKyB6eGyvkonfob1v4a:MC0HJm5FHuPgXDUDPHW8nfobZ
TLSH
T158A12AB1A4B948B759B7D345F8833A83DEA4A22769A0EF80D9DD1F0C01F71E81342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 46b5d639d43e082466d2a7ba3f65fbc9c50d255d7df9ac3579356e81d523ee1e
MD5 f137db909cabef14555155041f059bd2
SHA1 73edbd14d2a60bb16215328379ad4ae156c0fde8
SHA512 94300f372161fbacbe65519c4daf6a140793c3bfeb8078585ef01764f53bb23f0d06899e4169de35aa60aa8c27878093dfb383de43f7cc1d8dfe1cec39141023
SSDEEP 3072:CMEgf1PpGP03XQ0H+GESr/MRbbXwxkWpB6:BR1xTXQ0trg9Xe6
TLSH
T1A0D312F1FCF9AB66475DD94BF00A222ADEF58C9BD53497E82D2D8E0E14948BD02D2C41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 33cc5a8862a506f5dc6c6d4eb7e34c21d2f38625cf65e7afe88526be2a96da57
MD5 f68093466732ba812d9eb3af52a076b3
SHA1 c1f9eb9207106135025437e893f2065dbdace42e
SHA512 d467097c23d4fb6747d7963e0235dc44b416c4a1236dfb7e7eeb3435607894e99dc78826058ccc592dd4961be51a0a7a1783c21d32259162583f6647d6bb9cba
SSDEEP 3072:2MEgf1PpGP03XQ0H+GESr/MRbbXwxkWpB6:tR1xTXQ0trg9Xe6
TLSH
T1BCD312E1FDF9BB72825DD51BF00F222ADAF58C9BD17887E41D6E8E0E15908B902D2D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 2523ed5c62c8f1a72cf86a8a85808ed30efd6924a6671b23c4b2ca34335cc0d9
MD5 10230b89d251ebd97e1079a0e104377b
SHA1 872b21c27b813ad32e68823d38ecff4b99bcbbb5
SHA512 d451ef8ab763f7f0879350d35fa9fa2309a1dd04d9c0fe8fb11c18527f8b775387379c2ebfdf4bf7938e5d45ce12e7c4d1ac0b83b7ea20303d443430e17510a6
SSDEEP 3072:tMEgf1PpGP03XQ0H+GESr/MRbbXwxkWpB6:CR1xTXQ0trg9Xe6
TLSH
T14DD312E1FDF9BB72829DD51BF00F222ADAF58C9BD17487E41D6E8E0E15908B902D2D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4828_1646968198\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

free robux.zip.crdownload

Path C:\Users\Admin\Downloads\free robux.zip.crdownload
Size 1.5MB
SHA256 4e02795aae09edffb4b1d637928319abebe5b7c38c3c3b9619e5d20270205b45
MD5 ae052b21e59a2a598de27e546fc530ba
SHA1 bec76f3e4d4dca8aab8aca08d5967d21589c8fa6
SHA512 41909b7aad45db559f724e3380a3dde107678c44b53626481b5fed37bfd668d6086ee80b4e5a2f3f4d5532cdd00817d2dc01ce544391ec8836bfcb2ffb728cfb
SSDEEP 24576:aob5fwJhqMqus5vIzIQ65uILccFgK4KgxM7bTr26PfF6D7tQeoBT:aoVfi5qR0TzanFJVgy7XS+F6vtQeqT
TLSH
T12E7533E2DC523DC35CDCF6998340CB51572EE33E02F9399D2C821767199AAA5DD3A423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download