hxxps://roblox[.]com[.]ms/games/14153443454/Meet-a-neko?privateServerLinkCode=14262701585276358163745883890645

Analysis

user interaction
yes
max time kernel
900s
max time network
899s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/10/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://roblox.com.ms/games/14153443454/Meet-a-neko?privateServerLinkCode=14262701585276358163745883890645
Sample261004-c8a1ksgf85

Score

8^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
	\??\E:\	explorer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
	\??\F:\	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5848	chrome.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 42 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{57A18693-F6C2-47AA-9B1E-E048AAA443AB}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{88F60FF4-A4C0-4F41-80FC-0B34C99F4AAC}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
5144	chrome.exe
5144	chrome.exe
3860	explorer.exe
3860	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
5264	sihost.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe

Suspicious use of SendNotifyMessage 59 IoCs

pid	Process
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe
3860	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5676	StartMenuExperienceHost.exe
3860	explorer.exe
3448	SearchHost.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 1088	4400	chrome.exe	89
PID 4400 wrote to memory of 5848	4400	chrome.exe	91
PID 4400 wrote to memory of 1296	4400	chrome.exe	92
PID 4400 wrote to memory of 1296	4400	chrome.exe	92
PID 4400 wrote to memory of 832	4400	chrome.exe	90
PID 4400 wrote to memory of 832	4400	chrome.exe	90
PID 4400 wrote to memory of 4712	4400	chrome.exe	95
PID 4400 wrote to memory of 3260	4400	chrome.exe	94
PID 4400 wrote to memory of 4712	4400	chrome.exe	95
PID 4400 wrote to memory of 3260	4400	chrome.exe	94
PID 4400 wrote to memory of 2448	4400	chrome.exe	96
PID 4400 wrote to memory of 2448	4400	chrome.exe	96
PID 4400 wrote to memory of 3184	4400	chrome.exe	97
PID 4400 wrote to memory of 5028	4400	chrome.exe	99
PID 4400 wrote to memory of 5028	4400	chrome.exe	99
PID 4400 wrote to memory of 4224	4400	chrome.exe	100
PID 4400 wrote to memory of 4224	4400	chrome.exe	100
PID 4400 wrote to memory of 3300	4400	chrome.exe	103
PID 4400 wrote to memory of 3300	4400	chrome.exe	103
PID 4400 wrote to memory of 1552	4400	chrome.exe	104
PID 4400 wrote to memory of 1552	4400	chrome.exe	104
PID 4400 wrote to memory of 1636	4400	chrome.exe	105
PID 4400 wrote to memory of 1636	4400	chrome.exe	105
PID 4400 wrote to memory of 1668	4400	chrome.exe	107
PID 4400 wrote to memory of 2136	4400	chrome.exe	106
PID 4400 wrote to memory of 1668	4400	chrome.exe	107
PID 4400 wrote to memory of 2136	4400	chrome.exe	106
PID 4400 wrote to memory of 1268	4400	chrome.exe	108
PID 4400 wrote to memory of 1268	4400	chrome.exe	108
PID 4400 wrote to memory of 5760	4400	chrome.exe	110
PID 4400 wrote to memory of 2968	4400	chrome.exe	111
PID 4400 wrote to memory of 5344	4400	chrome.exe	112
PID 4400 wrote to memory of 5144	4400	chrome.exe	113
PID 4400 wrote to memory of 2460	4400	chrome.exe	114
PID 4400 wrote to memory of 2460	4400	chrome.exe	114
PID 5264 wrote to memory of 3860	5264	sihost.exe	127
PID 4400 wrote to memory of 4608	4400	chrome.exe	137
PID 4400 wrote to memory of 4608	4400	chrome.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://roblox.com.ms/games/14153443454/Meet-a-neko?privateServerLinkCode=14262701585276358163745883890645
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xc8,0x134,0x7ffb13e2c728,0x7ffb13e2c734,0x7ffb13e2c740
  2⤵
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,1671723721120147573,13821410327662351922,262144 --field-trial-handle=1904,i,5607140569583565751,16168375484652640426,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,9508999643557691289,16080199687177396633,524288 --field-trial-handle=1904,i,5607140569583565751,16168375484652640426,262144 --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,95485607786493845,13424386412897982900,524288 --field-trial-handle=1904,i,5607140569583565751,16168375484652640426,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:13
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,17541231357155818233,989377578230085902,2097152 --field-trial-handle=1904,i,5607140569583565751,16168375484652640426,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,12253410371381445924,13270372529883847375,2097152 --field-trial-handle=1904,i,5607140569583565751,16168375484652640426,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4708,i,16906416442621318078,12136046455767795197,2097152 --field-trial-handle=1904,i,5607140569583565751,16168375484652640426,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,2597916750472217609,16572931632095476588,524288 --field-trial-handle=1904,i,5607140569583565751,16168375484652640426,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5612,i,9478386592365122506,6766371612985495839,2097152 --field-trial-handle=1904,i,5607140569583565751,16168375484652640426,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5668,i,1282916923253986911,13729015586020913113,2097152 --field-trial-handle=1904,i,5607140569583565751,16168375484652640426,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5808,i,14749889847884439580,10431818593269374766,2097152 --field-trial-handle=1904,i,5607140569583565751,16168375484652640426,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5992,i,10219902713408887197,17029225185635519208,2097152 --field-trial-handle=1904,i,5607140569583565751,16168375484652640426,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5968,i,17078421612123781455,1714242533164082393,2097152 --field-trial-handle=1904,i,5607140569583565751,16168375484652640426,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5812,i,15140459122934773174,59973423127377199,2097152 --field-trial-handle=1904,i,5607140569583565751,16168375484652640426,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5672,i,15800198683753769337,3367439700663361118,2097152 --field-trial-handle=1904,i,5607140569583565751,16168375484652640426,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5552,i,5566296004069528362,974139818697455434,2097152 --field-trial-handle=1904,i,5607140569583565751,16168375484652640426,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=264,i,13644551380861320464,17843885653202150282,524288 --field-trial-handle=1904,i,5607140569583565751,16168375484652640426,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
  2⤵
  PID:5760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4828,i,18171259395174481404,4696419038476862951,524288 --field-trial-handle=1904,i,5607140569583565751,16168375484652640426,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,13609356172605709286,11706079290150432947,524288 --field-trial-handle=1904,i,5607140569583565751,16168375484652640426,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
  2⤵
  PID:5344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=792,i,5648059865410523534,12537213168916077332,262144 --field-trial-handle=1904,i,5607140569583565751,16168375484652640426,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3972,i,13555941654405044403,16490963727145329384,524288 --field-trial-handle=1904,i,5607140569583565751,16168375484652640426,262144 --variations-seed-version --mojo-platform-channel-handle=1524 /prefetch:14
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=1512,i,10857079609643498205,17105628017093517647,2097152 --field-trial-handle=1904,i,5607140569583565751,16168375484652640426,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:4608

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5128

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5264
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3860

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5676

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3448

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

44c0d5c0-02ef-4a33-a48d-c83ef275c44b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\44c0d5c0-02ef-4a33-a48d-c83ef275c44b.tmp
Size 5KB
SHA256 7265d57142893127086aaab2e08df8d2b789fc61227c3b73881afa3eaab1be8e
MD5 590bc972feb69a5a119f3d31103f4df2
SHA1 b90833734423e9e0fbb7e169c0446afb96177835
SHA512 5d34a28168c43d2d18fda602ccbf1168f6b919ec7cc857e3fdaeda4545e4e5b916096df1812f049e2cfa6df05127dd2b6a4459a3b2edc8c2006ace797e5ff514
SSDEEP 96:DbJod+7N0X7jVYVfGTVBsonSl8h4otop51cDRB6HGyvoD3EFq1BBcRNC39ISyVN+:DtoESKkPliU2onPp4Fq1BBcuCyZ
TLSH
T11DC11770A86DAC7B9DF6A895A0032D43CEB8706B9959BE58FDED1E0800E70DD1383527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

618a0151-bf22-41d3-b161-aeb633598085.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\618a0151-bf22-41d3-b161-aeb633598085.tmp
Size 4KB
SHA256 4d28b53ef72900ae359c50525bd7c195ab4ed9b3f483af91b2a96164f851284c
MD5 66f92e94013cd94163eb2f374956a81f
SHA1 c4c1657aa80de0b73a5e200d5b685d5191163b35
SHA512 366ab51374d2068e76f471bb7461cdb34cb00c6e0ed8e00d9ba90854c68432112e54e930cdfd34e086782eb2c60f1f585d2af04b9a64c83c8222829fbe0585bd
SSDEEP 96:fC0d+7N0X7jVYVfGTVnsERDotok51hDRB6FGyvoD3EmwB+Tbv4v4a:fC0ESKkdDUDDnBp4mwB+Tbvi
TLSH
T12BA10831A8789C7B59FAD888F8832A43CFB4707BD462AE94E9DD0F0814E70ED1341567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43144a5b-760b-4da8-995d-fc69e244d322.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\43144a5b-760b-4da8-995d-fc69e244d322.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

7b84240d-5a5e-4f91-9515-d9d85a8a51af.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7b84240d-5a5e-4f91-9515-d9d85a8a51af.tmp
Size 11KB
SHA256 f68dad318811f21f480aae0a9819bad48456c0e8e7f695c880834ba50f49978e
MD5 6e681a14339da9e140320483e4e09530
SHA1 431753794aab879a766ae9bc82b092accbfa376e
SHA512 0670522dc12efa6163967465b4047a9a652f1b6e03cc8257aec2247879b46ecd4c909d5db6e3d32f06841b7a151e32ebebf6174c8a295acd803376592693f2b0
SSDEEP 192:RRbFDsZUv7YvAPRp2ty9xHsb+WNn8B/D/2dfnfIkwzVyIsnAUge:RRbFeQk6X/DwoD2RQ1e
TLSH
T13732A32EAE24397F8CDAC219FA257B53E7F5202120E42EC4EAFC892C25D75CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95b2f865-84d1-441e-a51b-f0f3566300fd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\95b2f865-84d1-441e-a51b-f0f3566300fd.tmp
Size 12KB
SHA256 51f61ff11215ff84014aea2666434debeb5a8fd75ded207c845ba8eed7cdcaa8
MD5 b41184fdf0d3f2910b454d09efc2faaa
SHA1 f2c6a73b975d7b98dc1416361722eb61724feb45
SHA512 0ded194faa4b86309a6365cf6aa5aacba8699ffdfc1091c9af7f269e33ec1dff627fe0a8bc15abc49d95f6d4439d0a1b5272d2b1fd9927323cb32f17cacfd083
SSDEEP 192:RRbFDsZUv7YvaPRpRty9xHsb+WNn8B/D/2HfnfIkwtVyIsnAUgE:RRbFeQkEXGDwoD2vQbE
TLSH
T17F42B62EAD20397F8CDAC619FA157B52E7F5202120E42EC8EAFC892C25D75CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000029

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029
Size 41KB
SHA256 2d73eefd868f115745117f76888a9b0124453918522046796a55c3621ad2c15d
MD5 60df02cbc9b6a531c2d3cf32025a4dc8
SHA1 71ce31d6e0f59f98855a01b3eb9a37a86352189f
SHA512 cfc2d4bc147bc757054c07a7e347091922d4ff9b7a0f856d0a3c278f5a98fac1a539d05ea5c375868b372f006a530d14558ac7027723f83f3b22087bd12992dd
SSDEEP 768:xukYPFrf/S2LrwItWogYvYt+8GNUOvhc/st7yJR0M2+FAuuUsVpT/dEDzY4Ro/TY:xcfZL8ItW0YtJmVvK47yLt283JQ2DzYY
TLSH
T17513F1E998621410B0F35FF8A8BB89B551FF1E3D8EF955195D882507D76103829463EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 93f0a938035ee675914a0bfc71d06c67507cb6ca04b2dcbc18d1290fcbe30886
MD5 1d7e403b3a4cc02edfc71c612124f01a
SHA1 7cb7fd5d6ac614a160d33c07b5dc2922b9d3106b
SHA512 e3524882f28782c14ff873a06bb827416228154d0de15a6203a80d2ad08d6e8a65b61d198f8e32d62748be26456670c6dca59b573f7ff449d7610b8ad99169ab
TLSH
T182412CD0B0D060B6FF1C1A787F073EE822623B84406EC3875A86AC167C836E34757790
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 de9407530bf660bc540c0c6940347308317f6f6916ff53992dc8ba30fca0020e
MD5 37c537a7720bb3298c9d06a64863eefd
SHA1 4a896cc702533e6209ebe868aa2072290ed8379e
SHA512 8a2703af6792aa3fb65223c595cd7ef1f0efe4dcb3f76399e0072fcdabae000ed30dfe9d65fc9123d3baa4bd61067d25cd250b927eea251b9194e9025207dbb7
SSDEEP 48:zchi4Bf6B0QNkFRV52QC2tn/BcuhjRxYTBO9ny5lDagxag9XdWXJA+z/khn3YNvL:Ciofk0z2Qn/dNxYTIByiU9XszAximk
TLSH
T13AD108ACA8D0616DFF3C867D6B86BDD451213A9C50AA83437C9568217DF31DAE3077B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

0298ce3e-414c-406b-adcc-1e8389e97d96.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0298ce3e-414c-406b-adcc-1e8389e97d96.tmp
Size 1KB
SHA256 46db588daa809ed086a561b46514a92ef1414347175df6908a7f40bc5114397d
MD5 ee6952355ff2c6996b27a889a039a1cc
SHA1 2bb6e0c2d97d468722d585fb47e7f56d98e38359
SHA512 e9bde311afcaf7123537a152db4470482d836cb2c938474dd379e6a2f462f33671b17ec157330a54550ef0e9cc4e9074a134f8b9ecb611b69afaf310497084ac
TLSH
T131416AB7C3E49A7D890166F9AB192F1BCD290A15521D3C17C9D8AE1F57E28F2D24024E
MD5 SHA1 SHA512 TLSH

Submit Download

124d45cd-eb22-4823-a893-26a82e852666.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\124d45cd-eb22-4823-a893-26a82e852666.tmp
Size 3KB
SHA256 f45dcde46bcfd51fa2ae3a185ddeda659dd0bc3110d88d299c747c50280c0510
MD5 f65a9eee416ac6a1ee5ddc33f976b618
SHA1 8049901e2586d0c8bc55cd889fa3b1169662ac88
SHA512 6a35148624a0126d8c2e1a50350806413b2eab514404cc590c42aca4265c048d1d69f3c7983e09500a4f0d6797fa2173b44c146b37144e35d66a324507735426
TLSH
T13A818CF383E4D9AD990196F4E7156E1BCE6D0924431C3C7689D4BE5B53E24B2E20078F
MD5 SHA1 SHA512 TLSH

Submit Download

2ab19162-60ae-4a25-84d8-4a895f19ca8f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2ab19162-60ae-4a25-84d8-4a895f19ca8f.tmp
Size 7KB
SHA256 0112b11870062b1b259e6531bf06adfa3ef4bd51fdd62fc4f5159baa3ce10469
MD5 9a0efdab442f861a616b69ed28ab87ca
SHA1 655d5b4a68d7c865cf1422ad0e7dc20636d918b5
SHA512 43a78c420a9305b2c8e3f33c78e4976923951a9b8105cd5cfcd9c8ac52c56340b0c5bc4c089d162ae0a16a784010c14d7d77e3d26b011420f52c1f6602ad0a35
SSDEEP 192:DGtRi+Np6srT+Hr3lqUjm+bb10hFlGwZkqwhuHjGMA/dZHxHYmK:DoRnNp6srT+Hr3lqUj7bb10hFlGwZkq5
TLSH
T158F17BF383E4C9AD991296F0AB05AD1BCE5D0524435C387AC9E0BE5B53E35B2E20079F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60334c83-09fb-4ddf-96ba-69c73119483c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\60334c83-09fb-4ddf-96ba-69c73119483c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

60bdf62c-4889-499e-bd63-4afaeca02d5c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\60bdf62c-4889-499e-bd63-4afaeca02d5c.tmp
Size 1KB
SHA256 9c4af2ed5b86748058e364270ed1bed331cab900a9604114a394c8f5d89e39b3
MD5 57245af6c2984da26d1ebbce5fa2370f
SHA1 8a03ac9247e4fda9828475be3bd8fd3b87c738be
SHA512 c6e51f2c905652fe63ecd2cbead285160e4bec436416ed0212b91f0a7eaeffc86c503332c1b4e80cb0ea1893ff972bd35235db6b6dd23f5eb0404719f74be346
TLSH
T1AB418AB7C3E49A3D890166F9AB192F1FCD290A14521D3C13C8D8AE1F57E28B2D24024E
MD5 SHA1 SHA512 TLSH

Submit Download

70a288bd-f99e-441d-ae5a-ea9a3dd26d54.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\70a288bd-f99e-441d-ae5a-ea9a3dd26d54.tmp
Size 3KB
SHA256 ae1fd93255e6f4996b931ad09aaf6c1bcd09cddaaaf6f1fd91721d393d5f8d1d
MD5 da179fb2a3dddd1518459c13f455c628
SHA1 4d4fd4926229607dd8d88a8e53105d5afdac3cf2
SHA512 f7453513fce02b2e439094f626c21634ffe349b546587eda671da6241b4cb0faa6a6596db0d2f84d74db8345cd4cd34070d73f968ecf967c9792ceaf1ae26cc1
TLSH
T175818CF383E4D9AD891256F4AB156E1BCE6D0924431C3C66C9E4BE5B53E24B2E30078F
MD5 SHA1 SHA512 TLSH

Submit Download

e86d5370-0083-4902-b54e-dee56319a897.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e86d5370-0083-4902-b54e-dee56319a897.tmp
Size 2KB
SHA256 1e2e2def967b27cd850d9b28bae0076c0957ca27a97713c24b10b24caaa090d7
MD5 6ec924bfb327577a1c7bd8ed41d47f6d
SHA1 a169fbf4d65bc36c43e6d2cb89bd33aaed97a9c6
SHA512 5484cf2260ee8e4ac60a0365372d38b7aa0f3893a935ea2856ce7d9f9032c9fa534d188ebaabf5cb7f8e5c2ee7bf9d21e9155ac83a3a6a5dc59229edadc9589c
TLSH
T158416B97E2BF746F107A89BF1E147C0A69FDE4355152A4F8CE9B822D70C26F30751462
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 aa22535f37ff4b46cacc9cd5de9e68915cad30ed6c2d84da78e0ce061241ba58
MD5 be41accbf87e53a8836daf2d534e3968
SHA1 9111db2d1d3489e0d824f25fc262b89364a3d63a
SHA512 7c47dd44d3e52ba7ca510711bdaa7726c6914601a97b13c3df17b5c2937d906eaf5a576719dada5b032cfd04244406c161d6be6471dd66ff4e1b25cc5fde6ce5
TLSH
T11DB01210804B3940CC4446F01746509532444E31C0211606E2D0E6D5DC870F02115540
MD5 SHA1 SHA512 TLSH

Submit Download

e272a36a-6594-4be0-a707-ab58d2abf998.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e272a36a-6594-4be0-a707-ab58d2abf998.tmp
Size 12KB
SHA256 86e12bbd25c9fb439ffde4af19299120826e46cdd0cad8d50a3401e7b20367f8
MD5 2eb18a5dcc62c9388827c9c990f643a0
SHA1 ed925c547191ada9a875a7a4e267427f8cf34ced
SHA512 8d4803d14c5dc5625f22be6697e57c66720dc917d25e0ca47f54e7a0e1fa0b090a87f17d90a83d93c8d768c42591da71fe80209dd737f5d381c4765226ea69c0
SSDEEP 192:RRbFDsZnv7YvaPRpRtG9xHsb+WNn8B/rZv9ex/fnfIkwtVyIsnAUgE:RRbFevkEXiDwo/exQbE
TLSH
T1F742C52EAD60397F8CDAC219F9257B52E6F5202120E42EC8EAFC893C25E75CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f41ded78-6952-4445-bbe2-c62585c3fc7e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f41ded78-6952-4445-bbe2-c62585c3fc7e.tmp
Size 11KB
SHA256 4e6c490de08d18d119a36d022b04ea6edb18ea6dbca11b046ee3b6ecb9a67625
MD5 e2537e5a5003e698e025f5c391950f05
SHA1 f7cc9c27ae92f955ec25179b75a378e8bca060f5
SHA512 ab1425b4f0375174b6ca27624c90462f6eb2187f981633ab7a7ec0dd029fb931348ea8eb4317c89b309c0f2ba8d53d9010404994bf99cbbb61c74b8d65545459
SSDEEP 192:ezs4K6pN7KxkXqK4I40pUZNCgVLHrKHfFKslERbFXzKD/6N+ErUkKN9a7v+ANAPH:GsjSN7KxkXqKf/pUZNCgVLH2HfgsloFY
TLSH
T16832D917A84D6E7F0FD8D50DCC166F4B6DB5029676680D2893FBAD0803A57CE114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a6ef23ba-bff6-4d18-ba6b-e892595719cd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a6ef23ba-bff6-4d18-ba6b-e892595719cd.tmp
Size 5KB
SHA256 925ac3f8f644bf1445f662cacff789c9bb504faac60b7b42718ed4ad3f19eeee
MD5 37147b081666e3df939ec6fb4e01d50f
SHA1 e952fa9e5690a1ed53c17a58a780149361021ca0
SHA512 232c18de2b9d0efd99584c7d760e9ca4723892ec0358565f650c13604ca624c29298b4903f0c2456251e84e0697a2f89bb8997f194fb7c764940235a140a8fde
SSDEEP 96:DbJ0d+7N0X7jVYVfGTVBsonSl8h4otop51cDRB6HGyvoD3EFH0p1QzbpXKZj3BBi:Dt0ESKkPliU2onPp4FH0ca3BBzUR
TLSH
T1CCC10875B87DAC7799F7A992E0032A43CEB460BB9541AE94EADE0F0C15DB0ED1342436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e703516f-c089-40d9-aa3d-71ea243727f0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e703516f-c089-40d9-aa3d-71ea243727f0.tmp
Size 5KB
SHA256 0aea668652068aec550f880ef323d01a1f5cfecb4c48534c4c917b0f9eda3a3f
MD5 8ed609ee6fb02ddb69e028ee39792d73
SHA1 85d94f595df18dde9d73e5293e97e0145cba621a
SHA512 8bf1c2207b80893c9b57e42fcedac886394a6e18177a011c5155e44aea92692dd3f42cbe257991ad1f309ba4c9886ed08d46aec34ccc5fb5eb9d94687b8cc6c5
SSDEEP 96:DC0d+7N0X7jVYVfGTVBsonSl8h4otop51cDRB6HGyvoD3EFH0p1QzbpXKZj3BBz2:DC0ESKkPliU2onPp4FH0ca3BBzUR
TLSH
T1B3C11A75B87DAC7799F79991E0032A43CEB420BB9541AED4EADE0F0C15D70ED1342436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9d8b4c3-9b41-48e3-b2b2-20e05050a795.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f9d8b4c3-9b41-48e3-b2b2-20e05050a795.tmp
Size 5KB
SHA256 e12b02b12c8fb172f31c14b14dd890cd55dd0cb32ae1996486d42e8df1e1170e
MD5 961eacc7198f2a926909571dd5df208a
SHA1 7e9a7e41d1ce713eae8ede988f902a939fe48cc4
SHA512 a970f9fed1e67bf826f0a2fda3041cdf999d69f1d534cffc24e58b300986b5ad6eebe11bc1a7ef24c0a12443056cb3280e2ac701cdb5681aec651f523118505d
SSDEEP 96:DbJ0d+7N0X7jVYVfGTVBsonSl8h4otop51cDRB6HGyvoD3EFq1BBcRNC39ISyVN+:Dt0ESKkPliU2onPp4Fq1BBcuCyZ
TLSH
T142C10770A87DAC7B4DF6A895A0032D43CEB8706B9955BE98FDED1E0800E74DE1382567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3448-700-0x0000021883840000-0x0000021883860000-memory.dmp

Download

memory/3448-716-0x0000021894050000-0x0000021894070000-memory.dmp

Download

memory/3448-701-0x0000021893C60000-0x0000021893D60000-memory.dmp

Download

memory/3448-708-0x0000021883A80000-0x0000021883AA0000-memory.dmp

Download

memory/3448-694-0x0000021880000000-0x0000021880100000-memory.dmp

Download

memory/3860-870-0x000000000E6A0000-0x000000000EF1B000-memory.dmp

Download

memory/3860-1407-0x000000000E6A0000-0x000000000EF1B000-memory.dmp

Download