hxxps://samthepublisher[.]itch[.]io/roblox-hacks

Analysis

user interaction
yes
max time kernel
50s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://samthepublisher.itch.io/roblox-hacks
Sample261027-e8xkpabv2p

Score

3^/10

defense_evasion discovery execution

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3700	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2320	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Delays execution with timeout.exe 8 IoCs

defense_evasion

pid	Process
4372	timeout.exe
2972	timeout.exe
1984	timeout.exe
4032	timeout.exe
1140	timeout.exe
1260	timeout.exe
3336	timeout.exe
2744	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4360	chrome.exe
4360	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe
Token: SeShutdownPrivilege	4360	chrome.exe
Token: SeCreatePagefilePrivilege	4360	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe
4360	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 4612	4360	chrome.exe	85
PID 4360 wrote to memory of 1992	4360	chrome.exe	86
PID 4360 wrote to memory of 1992	4360	chrome.exe	86
PID 4360 wrote to memory of 2320	4360	chrome.exe	87
PID 4360 wrote to memory of 3716	4360	chrome.exe	88
PID 4360 wrote to memory of 3716	4360	chrome.exe	88
PID 4360 wrote to memory of 2104	4360	chrome.exe	90
PID 4360 wrote to memory of 2912	4360	chrome.exe	91
PID 4360 wrote to memory of 2104	4360	chrome.exe	90
PID 4360 wrote to memory of 2912	4360	chrome.exe	91
PID 4360 wrote to memory of 1760	4360	chrome.exe	92
PID 4360 wrote to memory of 1760	4360	chrome.exe	92
PID 4360 wrote to memory of 4440	4360	chrome.exe	97
PID 4360 wrote to memory of 4896	4360	chrome.exe	99
PID 4360 wrote to memory of 4896	4360	chrome.exe	99
PID 4360 wrote to memory of 4600	4360	chrome.exe	100
PID 3700 wrote to memory of 2744	3700	cmd.exe	108
PID 3700 wrote to memory of 4372	3700	cmd.exe	109
PID 3700 wrote to memory of 2972	3700	cmd.exe	110
PID 3700 wrote to memory of 1984	3700	cmd.exe	111
PID 3700 wrote to memory of 4032	3700	cmd.exe	113
PID 4360 wrote to memory of 984	4360	chrome.exe	114
PID 4360 wrote to memory of 3692	4360	chrome.exe	115
PID 4360 wrote to memory of 852	4360	chrome.exe	116
PID 3700 wrote to memory of 1140	3700	cmd.exe	117
PID 3700 wrote to memory of 1260	3700	cmd.exe	119
PID 3700 wrote to memory of 3336	3700	cmd.exe	120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://samthepublisher.itch.io/roblox-hacks
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd6612c728,0x7ffd6612c734,0x7ffd6612c740
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,2594319201920216466,4857463686437384095,262144 --field-trial-handle=2004,i,17056536233622575548,5710777149613348794,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1568,i,9323480270788546041,6353553490074497985,524288 --field-trial-handle=2004,i,17056536233622575548,5710777149613348794,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,17917941048716919331,3911405140311025821,524288 --field-trial-handle=2004,i,17056536233622575548,5710777149613348794,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2280 /prefetch:8
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3164,i,10722632757117096611,16280172731213478408,2097152 --field-trial-handle=2004,i,17056536233622575548,5710777149613348794,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3168,i,14067985103563211065,8201431199229282123,2097152 --field-trial-handle=2004,i,17056536233622575548,5710777149613348794,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4336,i,15027955087206187503,14452689787330026391,2097152 --field-trial-handle=2004,i,17056536233622575548,5710777149613348794,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4372 /prefetch:2
  2⤵
  PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,18427469924783451517,9750413148605155414,524288 --field-trial-handle=2004,i,17056536233622575548,5710777149613348794,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5548,i,7339060959805651075,10569494636319999767,2097152 --field-trial-handle=2004,i,17056536233622575548,5710777149613348794,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,1583411253214722274,1826123416208178209,524288 --field-trial-handle=2004,i,17056536233622575548,5710777149613348794,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4564,i,3483475077087519345,15944412953982895813,524288 --field-trial-handle=2004,i,17056536233622575548,5710777149613348794,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3156 /prefetch:8
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4344,i,10726572256253360062,13311106467098999416,524288 --field-trial-handle=2004,i,17056536233622575548,5710777149613348794,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3312,i,1727026231555400871,8691063007122901249,524288 --field-trial-handle=2004,i,17056536233622575548,5710777149613348794,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:852

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:916

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Roblox Hacks\Roblox Hacks\Robloxs Hacks Installer.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:2744
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:4372
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:2972
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:1984
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:4032
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:1140
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:1260
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:3336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2877b7f8-8912-414e-8dce-93bdedd72e7f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2877b7f8-8912-414e-8dce-93bdedd72e7f.tmp
Size 131KB
SHA256 f38cad5e74e630ae012d08dba21fa4d3463c6ac6a862eab4157aa8f18ff1eae9
MD5 6dc535d211561de507a72d44b101cb72
SHA1 6f401afd932c734ec4abacf6d463bb25d4c004fa
SHA512 fd81d5deef8be754d39c387e7cf9bbf781cecb518d6322503f413eae756ff2474095a8d4b3b8008f8d493d11cc0ac32053aeadd51f6a43251d91e4010675265c
SSDEEP 3072:EG+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:EG+hFD+7t56OD9ZfSApprr
TLSH
T15FD30232AA95D87B89FD6541F157A300DD72A8ED41DE3A09844A5F8EE09FD4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44f647d1-2e67-467f-9a6c-adc53cc8209c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\44f647d1-2e67-467f-9a6c-adc53cc8209c.tmp
Size 130KB
SHA256 61fcb2a259c7150eae8d9bda619175b81460f2d5520695f2171b5799ac7a403d
MD5 8883f3d019ff0f8b00eb8f2cce6474b6
SHA1 5ed803e64ca310d71632b15d9ae4e0f11a382281
SHA512 b7953e47d5eaf02dd079e30337297542e9f1c97c5b5f16b8ec949bb2582fdc9e910b38ae05e6581616127dc1083275f99efab12f9036b53cc814c738aed03eb4
SSDEEP 3072:p+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:p+hFD+7t56OD9ZfSApprr
TLSH
T12ED31232AA95D9BBC9FC6541B157A300DE76A8ED41DE3A09444A5F8EE09FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75fed58d-8fef-4de8-8b32-54fdcc48c862.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\75fed58d-8fef-4de8-8b32-54fdcc48c862.tmp
Size 131KB
SHA256 5ad4fe37bf80ff138a1c64eb4b8474515b7e8ba8035e3bb11f4b4cb6d58d0057
MD5 c0aa7069c2b12cf9c7a83a42ee0d9616
SHA1 a09d256e2bfb5eaeaf8be16f2510f047f9ea0580
SHA512 52be9407168837528da88c8aa6f53c09d25cf77d368dc92cda404a9c97f7f0fc423c09d3f4e105dd6eca09e93a5db6a724f0d936ecbb1fd18c58fdea93ab8b32
SSDEEP 3072:El+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:El+hFD+7t56OD9ZfSApprr
TLSH
T176D30232AA95D87B89FD6541F157A300DD72A8ED41DE3A09844A5F8EE09FD4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 8256c1e7622729c8ed5e3789587c3ee8d4f8f07403fa02195eb6fba9ec13911f
MD5 dfa4630601879ef786557c05c9d5aed3
SHA1 382d14423cbbb0e30a4d37eb87354c5ce473accc
SHA512 ba04920f41d72c2b3df7980dc5f18022ec63082e0efb2a715c828b7d8562263f888712a38dbdf71fe8975006b0dd2dda662ab387727ffba0ec6b21a77d3d811f
MD5 SHA1 SHA512

Submit Download

2eb827ef-3264-455c-abd9-62d6cb70dbcd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2eb827ef-3264-455c-abd9-62d6cb70dbcd.tmp
Size 14KB
SHA256 b494e61f07372ec9c7e51cecb31e35f7b1764c9454464712d269b67764c84218
MD5 779b83eba2269d00b677242dea1e1e0d
SHA1 4c0eeebf4312622db708a61e247a5a2a742d6b5e
SHA512 a0dafae9dea8b578fc1e281968512282b6ec5965118828fb163155216d9e94f3cdfc5a61b7a4f5636d6bb5bcc89c2c71d8f6810856f0ed434ef44469c50837c0
SSDEEP 384:LljHG7KxkXqKf/pUZNCgVLH2Hfgsl++7pLuLceShMXODHC+ErU3Htb5w9:L1HG7KxkXqKf/pUZNCgVLH2Hfgsc+7pY
TLSH
T1E562F867AC4C9E3B0FD4D649CC177A4FEDB4025621AE886482FB982503E4BCE110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3fac5e8b-c605-4b3b-b6dd-5dec8f8fc10e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3fac5e8b-c605-4b3b-b6dd-5dec8f8fc10e.tmp
Size 12KB
SHA256 66d737ac08870a853b499730704694bd24c7a8675053f95eade789d544af48fb
MD5 c2e219ca1790957dab23884e7665f4d2
SHA1 6014309e530a04e367b2dfd31b1cfd31931a4a0d
SHA512 89bed0c2c78c704214e5aa998b5773c53d37bb77101011ab0dcc264486e9c3a1f49ac599b8870edb373199a98d133c9319e8b1d22c77f5d3c7421e22446b26fa
SSDEEP 192:NR+wWTzFrr47yh63v7VNDpAPRp2Ule9QHsb+WNnr4I2zA2CkmYeg2qYVyIsnAUge:NR+wWTdrUpfZxUXcWwcIJ2LmG2q8e
TLSH
T17542942DEE10B97B5CDBD22AF9267B53D7F6102220952E84E6FD893C15E79CC2223417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

692ace63-2700-414d-bcb1-d8708f93d80c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\692ace63-2700-414d-bcb1-d8708f93d80c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d3506e3ceded3b6af5031a41bb3a9fc03cb0f2077df233a1328f7a553f13b053
MD5 eb9dfe6a2209c45d06a8969db10cb05a
SHA1 ffd6f38439c5e722ef7f81dfd9d468187174c52c
SHA512 200a12e35eacff861bf29c8329155f99f3a3c2d2fd4463f64d2eb608ef3187e9951d70c64a674b9b28590be15f3a7efb3f8f7b1e844036cac0528a77076e61b0
TLSH
T1D0E02BE5D862FC372DFD075D65254646E75113573781494B3A3DC10D4FB022641C68AC
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 288B
SHA256 ee011399c1339d4fef468085d8c5e2f680dc8f7982a5fc7b5737999a468d11e5
MD5 8133d49bbee491e0df62832747f2ac92
SHA1 e5c3c9178ac3548e8ecc6234d372e582ebc0b70b
SHA512 f268ccf40d6f2e0493a86d19db846e3f4a668c94877e6705dcd84651bff6a77202330e7d908646376c2f7c3ecdb6cb1654e87e1dcb6560198629438af1c27f6f
TLSH
T1D2D0A78165401331DFD7993964BB08D91B70ACD8491A226381C8543407533D74CABA2D
MD5 SHA1 SHA512 TLSH

Submit Download

46a52be7-97a1-44c4-a822-921288482ad0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\46a52be7-97a1-44c4-a822-921288482ad0.tmp
Size 840B
SHA256 61685786d1d6a1374de3859bd49f39f0be35c5bbe55f191c429ba4f7bcf40e74
MD5 1ed37f5122f8cae544067e8a2f14e031
SHA1 5e48c5c306456e799849821f615c1709c6089558
SHA512 28c8841855704ce1361508b64ceab59967367127741357d88431103d30837e2f6ab07c601309e645122fe90228f938c2a0a29faf793799d97eb0b3bb2864486a
TLSH
T12B0148A7D57EB4AB60BD4DBB1D00BC061ABAB436065168F0CA97836D70D58E31F06423
MD5 SHA1 SHA512 TLSH

Submit Download

b422c4c9-383d-4bb3-bf2b-0c83cc0a5d74.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b422c4c9-383d-4bb3-bf2b-0c83cc0a5d74.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

bfa877a0-65f4-4752-97a7-b0c566fda3a6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\bfa877a0-65f4-4752-97a7-b0c566fda3a6.tmp
Size 4KB
SHA256 e835cde2c5472b9e5963ec1d9c34f3fc482da7f920e7a073dfc34cb381d0c6b2
MD5 9611c3fb7b9cc92e39aaae5f9c71bfce
SHA1 e049eaa1b9de62f51905b79c874833510294cf42
SHA512 85cb1963536439a2f552fcf1c97827d0ccf1d41a4f16d56e6cf58dc130a7e2a471c802d281de5eec7feee875f24e90b5b2d5a6c09e092971ba2d55c5e12626a9
SSDEEP 96:DjzjV4JjboIaEadNJNjxjhoj9bqjhyjB8fjsjyjdKjFJjo:DjzjV4JjboIaEadNJNjxjhojhqjhyjBM
TLSH
T15891AFF7C3F4456DCA1156F4AA152F2FDE2A195A036C3C5788D8AE1B93F28B1E34064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 4acb80a9e80c63fe1befba3c334c88da5db9bbe3b81ebd8f0842d7e136dc63b6
MD5 a265d9baa362389bcdf503710a861671
SHA1 d5f9b4a386cdab40d20ada1f230cd41f95f69b5d
SHA512 0bacff491271bc1bef0bdf51d45d37bfe3ec0bd6898cc0517638cb232ff49973981160b21b70849b4b71c920b142feebc91e8d35fe269ca3a46d46f80064ed0d
TLSH
T17DB0120481426301C89302F0165234983154DF20AE09130541F00D21CC35261A02B0A5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 9245e02419f9f83bdf4ef7c608a681e129d23bc47e1431876e2c5078496c2a22
MD5 87a6c5724f6c3060013ceece14057d99
SHA1 f9a2a9bbd786b1a02ef3a27d7fc3b08e788aaf80
SHA512 83f263e92093824acfda0967f3c86ee8d4a6881561274142a92ba4ea356bfbf2cdf53ec2b075adbffb3223a7b88191acb8bc9f84974af1e7a30e5fafe97efddd
TLSH
T179B02200C002A202C00203B030C08AC8B0A2CF38C2030302E3E00F3ACC20230CAA03F0
MD5 SHA1 SHA512 TLSH

Submit Download

c846ec86-41d6-4826-afac-fabd7de1491f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c846ec86-41d6-4826-afac-fabd7de1491f.tmp
Size 13KB
SHA256 4099a809f152ec0753f1e0a94cae080bb94bdb9355e31d9c425b8c2dd896b10e
MD5 044b4e4cea28cf56f01e41cc5f5b0f62
SHA1 35a13e3fd79c3530e9e943eb87b4cba3239a7d4c
SHA512 67d1c5e000ead26f530102f0b1c0ac7f2dd677ea849dfc606fe377fbf7671d3a41c5b8d7c22b33931430bf9340cc4c96b6548efd6f04f45008b2c4f64ae69d7c
SSDEEP 192:NR+wWTzFrr47yh6Gv7VNDpAPRp2Ule9QHsb+WNxZr4I2zA2jkmYeg2qnPyIsnAU3:NR+wWTdrUpyZxUXcWw4IJ2gmG2qjE
TLSH
T17952942DEE10B97B9CDBD22AF9267B53D7F5102221D11E84EAFD892C11E79CC2223417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Size 264KB
SHA256 1d51a5a6d4f18bcc1e5f718bb3208759d3608b91e2ac05a0615c27b81ddde4ca
MD5 dd044d2a868ef4cda7c26b937a0c7392
SHA1 d0f56f204bec53cde467f7d0afe028615d47a991
SHA512 c7dba041fcb0b4dac1c9b173f4ac389593afe8f408003450716d01f74ad22b55935e5e0a361b8ba0f0e1b9dcf4a75d100abfb84322a3cf9ce2f4f4f5afd76b6d
SSDEEP 3:MsEllllkEthXllkl2zEklLx:/M/xT02zn
TLSH
T12E4404147FD0054DDD0C50304011D7500370D4101D11D7437C510C735CD55400C00110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cabb2681-9fe1-48b7-a9ab-ad400feb8cfa.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\cabb2681-9fe1-48b7-a9ab-ad400feb8cfa.tmp
Size 131KB
SHA256 440f2e78dd5eda1c3d0f270db4872d75b3225106e2c57cc5d425c71a9fb58b11
MD5 de275465f780b97e8feb15748d01b4c1
SHA1 9ac30cf7e7a652b62591b0124a6108440a7306a8
SHA512 c1ea7c445bdf642183092ef2cc6f70684e1f5efb819217c713f2b679f44c99ae47a29cd804a22d4ed68778e8f90104311411ce1f33d6ae48476bdfff1f5b0adb
SSDEEP 3072:XG+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:XG+hFD+7t56OD9ZfSApprr
TLSH
T1DBD31232AA95D87B89FD6541F157A300DD72A8ED41DE3A0984465F8EE09FD4C03B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

456e38f3-14ad-41e1-8156-0f3aa21714e3.tmp

Path C:\Users\Admin\Downloads\456e38f3-14ad-41e1-8156-0f3aa21714e3.tmp
Size 637B
SHA256 4e864d3f4e4a26dd62383291322c4de542d3b3b9d73e8240493cba69d6ac1503
MD5 bd72c5d03edec4bdc5f081880fbbe1d8
SHA1 bb250e059a9427b352b2cfee71a7b14ace494be7
SHA512 0c175a28bd0f3c7ea32bd27b99668d2c5cb2386bf3c2a9c942e895ef9760c172b1f5d8986c110e662705fb038cdf590734da4f01f553ef64691fc9608170936e
TLSH
T1E0F0ACF4DBE51015F886233E547BE8FC855FC40C0F2A5447D64C31681BC64802B382C6
MD5 SHA1 SHA512 TLSH

Submit Download