08f520b5434f12c10d9464977d77dd6871e61aee64a21c99a0e204178a5e3b1f

Analysis

user interaction
yes
max time kernel
898s
max time network
498s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/04/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Screenshot 2026-04-16 2.37.53 PM.png
Size 194KB
Sample260417-tpg38afv41
SHA256 08f520b5434f12c10d9464977d77dd6871e61aee64a21c99a0e204178a5e3b1f
MD5 15a55053f242a7aee2df26e7e41cef14
SHA1 e2212bb60393c49d2a4fd9fc4b3e5a6b05509403
SHA512 aa7c3892b31350a3bf1cd2ff24979038e977e55f312bd094efdbdbcec3f11b8b57d09b0c44168edd2a068c8c9f1646662c9d88487a8833fe2e3764d95f86bd4c
SSDEEP 6144:ie9la7Z6F2Y14oRN8+kply00pJiGY4w9k:HuV6P4o4DkLh
TLSH
T154141255B0D063B5FD8185B8BA6DD4519A3974064FA0D3BFBC37B01CAB1BE353E604A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
193	4372	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
1228	RobloxPlayerInstaller.exe
4564	RobloxPlayerBeta.exe

Loads dropped DLL 1 IoCs

pid	Process
4564	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4564	RobloxPlayerBeta.exe
4564	RobloxPlayerBeta.exe
4564	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\StudioConvertToPackagePlugin\placeholder.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\MenuBar\arrow_right.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\graphic\player-tile-background-dark.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\DraftsWidget\newSource.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\scrollbuttonUp_ovr.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Input\AimStrafeButtonPressed.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\MenuBar\icon_more.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\sky\cloudDetail3D.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\AvatarEditorImages\Sliders\gr-slide-bar-fill.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\graphic\Auth\gradient_bg.jpg	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\btn_redGlow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\InGameMenu\ScrollMiddle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\fonts\Inconsolata-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\PlayStationController\ButtonL1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\sky\cloudDetail3D-bc4.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\loading\cancelButton.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\option.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Emotes\Editor\Small\OrangeHighlight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\advCursor-white.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\FaceControlsEditor\checkbox_unchecked.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\LegacyRbxGui\Cinder block.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VR\notifications.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\fonts\RobotoMono-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\AvatarImporter\button_close.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\icon_placeowner.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Chat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\fonts\zekton_rg.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-ingame-14x14.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\AvatarEditorImages\CircleCutoutLarge.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Menu\buttonBackground.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Settings\LeaveGame\artAssets_DownArrow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\fonts\families\Arimo.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\ImageSet\LuaApp\img_set_1x_1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\particles\forcefield_glow_color.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\Emotes\TenFoot\SelectedLine.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\AvatarEditorImages\Sliders\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\ui\LegacyRbxGui\health_greenBar.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\content\textures\FillCursor.png	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4372	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209160736721845"	chrome.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-9d412f44a6fe4081\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-312252282-3884318443-358092420-1000\{9A958A21-402A-430A-B2B1-E1D2064923BC}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-9d412f44a6fe4081\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-9d412f44a6fe4081"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-9d412f44a6fe4081"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-9d412f44a6fe4081\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-9d412f44a6fe4081\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-4e426689616b482d"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
948	mspaint.exe
948	mspaint.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
5388	chrome.exe
5388	chrome.exe
1228	RobloxPlayerInstaller.exe
1228	RobloxPlayerInstaller.exe
4564	RobloxPlayerBeta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe
Token: SeShutdownPrivilege	3792	chrome.exe
Token: SeCreatePagefilePrivilege	3792	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe
3792	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
948	mspaint.exe
948	mspaint.exe
948	mspaint.exe
948	mspaint.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 2904	3792	chrome.exe	90
PID 3792 wrote to memory of 5892	3792	chrome.exe	91
PID 3792 wrote to memory of 5892	3792	chrome.exe	91
PID 3792 wrote to memory of 4372	3792	chrome.exe	92
PID 3792 wrote to memory of 2716	3792	chrome.exe	93
PID 3792 wrote to memory of 2716	3792	chrome.exe	93
PID 3792 wrote to memory of 6068	3792	chrome.exe	95
PID 3792 wrote to memory of 5608	3792	chrome.exe	96
PID 3792 wrote to memory of 5608	3792	chrome.exe	96
PID 3792 wrote to memory of 6068	3792	chrome.exe	95
PID 3792 wrote to memory of 5780	3792	chrome.exe	97
PID 3792 wrote to memory of 5780	3792	chrome.exe	97
PID 3792 wrote to memory of 972	3792	chrome.exe	98
PID 3792 wrote to memory of 972	3792	chrome.exe	98
PID 3792 wrote to memory of 5544	3792	chrome.exe	99
PID 3792 wrote to memory of 5560	3792	chrome.exe	102
PID 3792 wrote to memory of 5560	3792	chrome.exe	102
PID 3792 wrote to memory of 4404	3792	chrome.exe	103
PID 3792 wrote to memory of 4404	3792	chrome.exe	103
PID 3792 wrote to memory of 1212	3792	chrome.exe	105
PID 3792 wrote to memory of 2460	3792	chrome.exe	106
PID 3792 wrote to memory of 5584	3792	chrome.exe	107
PID 3792 wrote to memory of 4732	3792	chrome.exe	111
PID 3792 wrote to memory of 2192	3792	chrome.exe	112
PID 3792 wrote to memory of 2192	3792	chrome.exe	112
PID 3792 wrote to memory of 5696	3792	chrome.exe	116
PID 3792 wrote to memory of 5696	3792	chrome.exe	116
PID 3792 wrote to memory of 5388	3792	chrome.exe	117
PID 3792 wrote to memory of 3828	3792	chrome.exe	118
PID 3792 wrote to memory of 3828	3792	chrome.exe	118
PID 3792 wrote to memory of 444	3792	chrome.exe	119
PID 3792 wrote to memory of 1228	3792	chrome.exe	120
PID 1228 wrote to memory of 4564	1228	RobloxPlayerInstaller.exe	123
PID 3792 wrote to memory of 5728	3792	chrome.exe	127
PID 3792 wrote to memory of 5728	3792	chrome.exe	127

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Screenshot 2026-04-16 2.37.53 PM.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4072

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa1294c728,0x7ffa1294c734,0x7ffa1294c740
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,3380497045756430612,17998599915674693672,262144 --field-trial-handle=1952,i,14225787208847889450,13852792146333380689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:5892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,6768929234051509730,5797840852858141137,524288 --field-trial-handle=1952,i,14225787208847889450,13852792146333380689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2220,i,16008355271346287041,9086530281089910869,524288 --field-trial-handle=1952,i,14225787208847889450,13852792146333380689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,11328270834341707032,11878171318909201474,2097152 --field-trial-handle=1952,i,14225787208847889450,13852792146333380689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,739174059068152396,1356789161846634788,2097152 --field-trial-handle=1952,i,14225787208847889450,13852792146333380689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,7700780975763404045,1576926615922580082,2097152 --field-trial-handle=1952,i,14225787208847889450,13852792146333380689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4476 /prefetch:2
  2⤵
  PID:5780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4768,i,10140251204764799109,16241843042832137524,2097152 --field-trial-handle=1952,i,14225787208847889450,13852792146333380689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,13500776633604237677,15183537892684066187,524288 --field-trial-handle=1952,i,14225787208847889450,13852792146333380689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:5544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5536,i,12185831859394608460,16469360937300149282,2097152 --field-trial-handle=1952,i,14225787208847889450,13852792146333380689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5928,i,1042286172078998967,11163124888498130605,2097152 --field-trial-handle=1952,i,14225787208847889450,13852792146333380689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6132,i,7286560970432495106,3843766518536220356,524288 --field-trial-handle=1952,i,14225787208847889450,13852792146333380689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=240 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6136,i,7341971214621976930,3277707090234431122,524288 --field-trial-handle=1952,i,14225787208847889450,13852792146333380689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3304,i,4747612547299334477,5717031229010018862,524288 --field-trial-handle=1952,i,14225787208847889450,13852792146333380689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3456 /prefetch:8
  2⤵
  PID:5584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4424,i,10573018004290845681,14694798507847609872,524288 --field-trial-handle=1952,i,14225787208847889450,13852792146333380689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4480,i,15417708227528823689,8617899845549113450,524288 --field-trial-handle=1952,i,14225787208847889450,13852792146333380689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6440,i,747698777126905889,16535573995571216994,2097152 --field-trial-handle=1952,i,14225787208847889450,13852792146333380689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5812,i,4538167213496180728,11969577892415628119,262144 --field-trial-handle=1952,i,14225787208847889450,13852792146333380689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5796,i,3648214902073213510,10958621428246001907,2097152 --field-trial-handle=1952,i,14225787208847889450,13852792146333380689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,14828675732866463827,16628899726279354802,524288 --field-trial-handle=1952,i,14225787208847889450,13852792146333380689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:444
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 1228
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4824,i,687821523209422889,18362610945881061324,524288 --field-trial-handle=1952,i,14225787208847889450,13852792146333380689,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:5728

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1700

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.5MB
SHA256 bbf413a40c8aa3bfdf44167f12f40b12f7bf5428925ee5e628416601a4064ae4
MD5 d15b05f13cc22e65dff4ed6c0ea6a4f4
SHA1 7cb4025dbd9fa9dc229b1a327cde8a0c9ae27249
SHA512 1e82163e1603d93e9e2409432923043c329f653b36a12b284b8e1b5d6f92edad4022ace52315d85431e8d522db6e2a446cac1a8cfcde72cf0a158035d5c9ffe1
SSDEEP 196608:x4PQlojheOkR8jCp6VdGOEF6wIfE9nmRKa0BBsLQs:xwLkWGXF6VfE9nmRcBs
TLSH
T1F9A6CE12F940C031E9D202B2A6BDAFB65D7C99241B3944C767C45DBC4A705E33B3AB6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files (x86)\Roblox\Versions\version-9d412f44a6fe4081\RobloxPlayerBeta.dll
Size 15.5MB
SHA256 80e1c990de61dc21b61a9c3f978236bfe1266cd0cc09af4673f9d73d91b3d8c3
MD5 1cbd430b2924d0686d6dbbd0e3faf168
SHA1 08ea475fcdfc0463ddf3bf393c90d7081b6a1ec9
SHA512 5b8d3d1c8d8b370619b4719aa03efd17891cd647e2d595828c8e0a0830897eb72d5478641c792877973e86c2fbdc7add46167222eaae3ead55f31c6bc4e5de95
SSDEEP 98304:Kf/AG0tdGNAnLI7BPHfoR8pRLlXSyTN52m6iof2+5Q3NKGv4qyDDo7W7Pwi/qWND:Kw/WpnRLlJx+fL63Bz9i/qo
TLSH
T18CF6BE5EF4E249A8D0B24035E15F13D3EB12B0CC476C69F707AC51503AB369EAA19F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f044d6429d5c2fdb302f1aee7e352ece015ad67fde6e7550123a3ac937be5eb9
MD5 25bc3c99badd85007e232985b7bfdc98
SHA1 9cc7125ecb94862620e1580f51b672cdc40daa3d
SHA512 435b6835e8ffefc37880b5b2e0048e9d26cd55298fef2ee3e352754567ce198f5d933eb57364b329ff56397d3319cff29ab3ce5c632d50c36743a98dab61071f
TLSH
T1ACE02BBBC821D83B18FD476960510747EB00235A2BC0584F3F3D921D8FB467A058685C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 b09cc92fa3538f7694e559e1f0775d76bcc940769fd69be1a285a0e689736f44
MD5 50f6cc7423e11354d4a9246d661ba284
SHA1 06a9d8a91d4bb5256a5d1484133e72126bac19a9
SHA512 fcc3ada7587deec088e818ec9ae0c1ffb7dc4827bd5de408d6eece7261c6632d4a422c9e343338090c5831b0c5eb247a6b3d05bb467c506d66623a4b5ae29896
SSDEEP 96:U6nVCM1oFCvdBK2upDEy8wXwZPDTQrk6ZCaBqfZr/j4Tvqwr46EK+hz:ZCD4vbnup2wO1giwC
TLSH
T13481C47742D0E8CEEFA884B20A617C3F76E70521CA562B47EAC0176514E3FE0CD4A236
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 29949a0aeea9fcf3b4572dc12ca60247ada5f7d132e077a9bb5b5218b0b08e42
MD5 7f8a68a7be9b647f654ea58ca6ec3f18
SHA1 150efce9a093bd8ce829260277516739eb6fa473
SHA512 b8bcc3641f7bdf9e69be9b6fab116a82d430bb3584c0c720c334a50cc08add9370a33512d9c1f7c0ef7c1c63dffdffbf854561690990f24a07c008f45f9a6f24
TLSH
T10571A27342D0C5CEEF9588B206A43C7FB5EB0521DAA62B57EAC4173454E3FE08E49235
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 d8e5698d283235a1ea892442935c80ca17e38f77e52e1fa837899929c4ebdd35
MD5 fa0ecd59faf14fc618adc86686e1caef
SHA1 73289cf985c2dc1a87ae3ca87792018bbbee93d4
SHA512 1900ace3390d93d61b115b4cf89f73d2bdf5a094f30d315f63bd3f1928264c8a0c319c5c2b372d3289de890f7975d8957b949fb44cbc7b8d35d05a78af09dcdf
SSDEEP 96:7LnVoM1iFaOv671jKbotpEJ0ZaIxfxzrTQav6Z6OIqfZD8VZ4QvbP56rCnU:7poZgOv65j2otO+NxdTG
TLSH
T100A17DA271C8D59DEF9C83B206A52C2B3737C910D6536B07E9C4CD2F0553BE28D56222
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 7f6595ad3f9337629c7adae3c36660b5650cb75af0d8355b665177f9173abe00
MD5 45b49e037c6245bd578df2160ec73931
SHA1 2ae94c64cd0402496454fa8409b920b98a5ebd21
SHA512 e9c59e8016fa6d6b8b67ecc625e51f04891a909d66f308f98271562998facf1b2adcfab504de09be85ae50c72511770c57704f8978063fe979e0d0904db480ee
SSDEEP 3:MsEllllkEthXllkl2zEL/LK//:/M/xT02z2L
TLSH
T1CB4404047FD04405C5001134F013C7501370D4104513D7437DD5D4335CD5FC00C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old
Size 387B
SHA256 a0662b4ce845774f7200e84527488e5005139f7ac51f58735a23a5f8bb13c3c2
MD5 1dfb93c6e1a7f5ad4eb86545201b6150
SHA1 fb8d1838e4859713d316544e8f0f022c22fa98a4
SHA512 e61fd7df140f36d26d61e492d274e2493a781530449658c2006a9ac81c416d00f3c0a4419a60b4d778c470ac1242516f5803e48f0ddf1190489a6b1c7e585c7a
TLSH
T160E02BB812AED9EF20DC8013516CB70DD7D23A0E97DDAD855B02E464B1C3008A7B4260
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old~RFe5a5fe4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG.old~RFe5a5fe4.TMP
Size 347B
SHA256 1b1604723a8c4775f5aecf54bb1061ea3772e02650193b5787377e8e87480032
MD5 6c24f246410296ef0996e097d4b40255
SHA1 12ce2479cd134ec5d7ab1cfd39ecd3b928f9e8a7
SHA512 78b8e19f2d5fdfc25d5c2d1a525cdc0175a6682cc43a6e7e8468ff0f31b96dc72e02d167a8093b1a78a4f737d06181660929afdb607a2e9308af87bbbee2c0f3
TLSH
T137E0D86996C9D56F20D4C0A75538B70EDBE2151D97DDAD854F42E41471CB00C95A82A1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 8768c1ee2fe7236af968088b568e44c703da8fbcd7e2ca4cd915142331482fb4
MD5 f26e86bbae305b6e4c482e49c5a4d7f2
SHA1 f750863bc448ef68d3390c6a6f461f5a111d0bb4
SHA512 2c1374bbba5103c1ff20ad08274df3a1f61f7cc77457984a1ff9c1f27c2f15472b389760cd5b3d59b5e03d7af36b182c171b642a24f5ee075b64afdb742adb08
SSDEEP 48:YALlq5qUO9PhvOm9aXYfo7zsugmzsX4sofskosY7MaWsSbHxGts2nzsvQHA+sSf8:DuVkZX9aIaL4oRI7Ma+HxGRxHAowJ
TLSH
T110A19DF783E5C56DC51296F0AB15AE1BCE690924031C3C76C9E4BE1B53E29B2E20179F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 36d06504cdde5c9712a1744624567e53964dfe309c029da809d39cb8035ad1d7
MD5 19324f31ef782a8deaf8ce3f5e795df6
SHA1 59ad19c4ff0ede0f55481b1f452766ae7866c8b6
SHA512 74874e47e37305dbb16d4607b30a64fbccd64732800d60335e4f93afe962912d8ff15e12f6f8b40dac8e4b7405cc22e9a4dad17d013fd75ceda33121ef3a862a
TLSH
T14151AEB3C3E89A7D890195F4A7147F2BCD690A55631C3C9BC8D5AE0F53E28B6D20055E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 34dea7af6fdd399d7348548e30cbdbef24070734af05c12782a6d76398e3a16c
MD5 a2c1d4b77c7fcbfcef9610b683375970
SHA1 91c4b3ea875553c3c5d845a426410ea4ceda904c
SHA512 6e90e591e169b40c00a309f234c6dd494af3001e60ac3e84a431b6bdd9d62b8be3648499884870a0f379cc14f6985e0c9f50732f60e1a1a8fe7f87f92cdd6a02
SSDEEP 192:DuVkZXl4+KzrXaIaLTRIDPRgR4RbaQTjhniNHuGnfxk3HaA:DuVkZ15KzrXaIaLTRIDPRgR4RbaQT5iO
TLSH
T18102AEF3C3E9C56DC91256F4AB15AE2BCE290924031C3C66C9D4BE5B93F2972E20175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0c66a4723c19dd6174bf65add0be3041613fa9cc42ebd228e2dd1783f12947d0
MD5 f6db91c1784720aea695cd55ac52ecc2
SHA1 3b0f8e60ca9f873b3a22b6d020416053d37532ea
SHA512 8353b967c1eb75d0c842578344d20f2bdea826e63f0ebccee2fcf08265e7388b6049df879d3feaa476b306585de4981955f8c089473f962b4ad711c1c47b03b6
TLSH
T1AC51ADB3C3E8AA7D890199F4A7147F2BCD690A55631C3C9BC8D5AE0F53E28B6D20055E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 2451e3340c3ed21b329ea2d1210b3a42e833179a398d0a4b5631512301c79e6e
MD5 2729f5fb6d15d809d36303a56039c4da
SHA1 a8ce59e6d22e3652d3f4091050d5159fae6925b4
SHA512 e79f2ed35631f63333cb061e59aa3b71e3732f918c22efb770a0e0830d502fbeaf3da6cda446386a77a0960843c868588ae7fb9e3b6cec37b2cef05a56c746b3
SSDEEP 192:DuVkZXl4+KzPaIaLTRIXt/PRgR4RbaQTjhniN7HxuGnfh:DuVkZ15KzPaIaLTRIXt/PRgR4RbaQT5y
TLSH
T165F19DF3C3E9C56DC91256F4AB15AE2BCE290924031C3C76C9D4BE1B93E2972E20175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 3KB
SHA256 ad46ec9f6a4e26feac1fde905c136e3e1f25c9ac01ef0ab2d445ca8e23e690f2
MD5 70595ff9d545a7933fa17fb784edf6ef
SHA1 d180224734f2f5902d4df62a9cfd5ff159c76a3a
SHA512 5cc1a40cdd55a5ac41c770b8b484f0479d53e2198398da0281e1fa9dadb5487320c5a083e5c7df6fd804a1dfc489e4d92317f1d0e718d819ddb5fc016092bf97
TLSH
T1A061B19BE77EB81F703C09772E49BC1999B6AC3942D164F4CB7A812CB4C15F32B29012
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 573c9ee8cd065742754318a04c9371ea5d1ccd6dbf377554c78e243318f540af
MD5 d40e83bf5b7b088d5631f2c6257d298e
SHA1 1bfc6dc4066cf737e5196e969408711848fb3877
SHA512 4abc67b33f1dd7c8883d47dc984c7c76d49f5c31876db23073196d6c13db51219f651f118076345564f38b689c6ef72f1e40c144cb05f477aa00d4b2677b842c
SSDEEP 192:8RtWr6qLghSv7CMpAPRp2Ns93Hsb+WNnFTtN72F2+WKeVyIsnAUgtaJ:8RtWr3y+xUXXxwRr2wt8
TLSH
T16642A46EF914A93B9CE6C32AF9217B1BDBF1102161992E84E6FCCA3C14E75CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 138382b36feb9fb22393135e6a87016b7e6905c74cf3c672498ed337720cc709
MD5 25fd0c53668035e26957f1f77b89b7ae
SHA1 e8ccd3094f81fc78c42f3d35c33fb3ae8ef46c48
SHA512 2bcf1a255fcd246c72d61b6618d6c2379af155b0a4d74c67e025f2a2cbc92c06bbefc39fdd01c625750f38d5d3c6aadf22a0e7963788a21a03fd964fdcf7bbbc
SSDEEP 192:8RRcBzWr6qLgeLv78MpAPRp2fvcSY93Hsb+WNArS/GFT4oZDuzOz2+WK78yIsnAq:8RRmzWr3hzroX9xwipgOSPe
TLSH
T12962D86AF924697B9CF6C32AF811BB1BDBF1202165951E84E6FCCE2C14E76CD2207417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 9b76d6faf6bd64df9b3387aadf421f638a3d3631f98900f98fe75d8bb325dad7
MD5 72e5a298fe72467b55a9e01a2914d885
SHA1 8885c719860f0a530e3838313d78da5f077a8a74
SHA512 810016c9c0eee4bce960be6fa8f2d266db8c5d2a3ac7f3c98bedceb0954e5dffbac87f9ec45b7c943893975f9663a54a7a000de2a9971b816a46b3324445db4b
SSDEEP 192:8RRcBzWF7qLgeLv78MpAPRp2fvcSY93Hsb+WNArS/GFT4oZDuzOz2+WK78yIsnAq:8RRmzWF2hzroX9xwipgOSPe
TLSH
T1C962D86AF924697B9CE6C32AF811BB1BDBF1202165951E84E6FCCE2C14E76CD2207417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 058515fdc6b5e81176326b03ea569ac999fa7c4a26690553ee9150fb1a40989a
MD5 e017fc1b6241b4207969fba1bf3de99c
SHA1 e13b9ed300e70d6b78db689b9d2714646aaec5f0
SHA512 67b266627b494fd38672e41a7e688fc46bae41494f3cc54fb7dd27fcf0139507497b6924ed4a365cd548df1d749bd3c62799c50aed65f2deb7216c338b576453
SSDEEP 192:8RRcBzWF7qLgeylv78MpAPRp2fvcSY93Hsb+WNArSMfuFT4oZDvby92+WKJSyIsB:8RRmzWF2hyVroX9xwKEpnyoze
TLSH
T1FB62D76AF924693B9CE6C32AF811BB1BDBF1202165951E84E6FCCE2C14E76CD3207417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b7c4c9682d7b7b4a183eb74d26d4f58c29e8de5d0fe0b94e6f6bd949ef657f0f
MD5 628771999ed47e93591249c3e46f49b6
SHA1 456fb0c4adb148c7b7302d372ee0b5ba44f325e7
SHA512 b0752b294b288dd9949323271016563d6ed97d71ce2fee47e87189bd4658afc82ea702a63f86d6c5edf177a0aa70f25d69c9d66de5b4ecf6bb325121ba0ce3b7
SSDEEP 192:8RtWr6qLgh7v78MpAPRp2Nd93Hsb+WNnFTtuzON2+WK78yIsnAUgraJ:8RtWr3yDroXqxwReO4Pe
TLSH
T15D52D66EF914693B9CE7C32AF8517B1BDBF1202161992E84E6FCCA2C15E79CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 270cc1d45519e01d988b56976d0a0038d439e02673cb1f8a29fe9605986d399e
MD5 ab091a19f84378fe1b1dbf8464af4d63
SHA1 ea6880a9207292e77fa97a2d7782cd13fc7c8f73
SHA512 bb383136fe1dcaac38a0165141e6dedf37d56fb955bdbe28622daa21b3188a9ddf7bbe746f91296949113b14e0d5b9ef6295c44a4d7792ec502c0bb13f3a905c
SSDEEP 192:8RtWr6qLghSv78MpAPRp2Nd93Hsb+WNnFTtg2EW2+WKR8yIsnAUgraJ:8RtWr3y+rUXaxwRPEZ7e
TLSH
T19F52C62EF914693B9CEAD32AF8517B1BDBF1102161892E84E6FCCA2C11E79CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9c430f8c17feb865c008f25efcb04058f5ca91ec3e589c4f1ad8c3f157cbd990
MD5 d8cfe36a6891342c51bc518f22217e71
SHA1 73290bff0114201260216b0cb931cd9bda0228c8
SHA512 7e9778e0fd6323fceb05d3cc91303d1d284a486f525d995ef288db3363d58c76ff756e8e5e9add87e5a95e7ffd83adb3cf949ed5b7444a047d33f0fd1fa9184a
SSDEEP 384:AmjUj7KxkXqKf/pUZNCgVLH2Hfgsl5x7pLuLcifuvXODUf+ErU3xeHGHHe7omBcw:AGUj7KxkXqKf/pUZNCgVLH2Hfgsfx7pH
TLSH
T15772EA677C4C9D3B0F94C68CD816BF4FADB6024B55ED886443FA982903D5ACB110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a0dec8ee76fafd8966cf7bdf11677021a9b0f41d0e4a87c8efe5e78a193cecc8
MD5 4f553dff9bd6d3a8824dfc4711d78c12
SHA1 f396e52d24d9767ba45204f639f965eaa144a428
SHA512 53523de65ee923faf89bbe6d11a6f7b7ecb360e1080537c4542739e655f806f0d6a56b077e0d9fda2968cdf7f9f2807b7d51f9fc352ad46052fd08dc73237f58
TLSH
T18BB012608441AA81C40302F45AC2048C3554AF21C706130193EC7971D82A1B14014260
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c8ba.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c8ba.TMP
Size 96B
SHA256 14fd555b6a3adfe8d55955c67c99c57ade3214bd5affbbe11bf441af10d4c3a9
MD5 50a88979e6a6a16653bb6630779297d9
SHA1 72610a7b94feeb12db39776b79c878594c55b279
SHA512 c5d7f5af41220eb6a7359e99203d0b3661d96b1554811f396ce7e32b389b773c152255d64cc57539dff1cef4b61048a77431abd9ef5f7dfdccffb584c10921ef
TLSH
T13AB00259C247A713C0C203B42EA695F87160EF3ECA03135797E01AA6DE296B84525564
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 01c30d13f206337a51abe1031a86a61420ae8e8cf393a8c4a2e7d8ce9015bb65
MD5 a1743e175cf9650f8341194c990078fa
SHA1 e7ece83005a5694ed114586df0bac3d7c460535e
SHA512 fe76e8fa092d8405ee771af355e3417d8f346f578d23de2c699ee8e82ea7a76d5bc7b6e47d5f1d7c04ba55990a30a58070c8b0bc95db49aabd68034c0d1cac04
SSDEEP 3072:dKu7sLxK4avMAi/v8XsMjiJpJHHWDjeqC3Qw/xLANk0mUW5GmRntSFCjEEN4:dKuUxK4akAMU94VrOk0HOGm/SFyEES
TLSH
T1D11412BD8E1F19B36CAE496B718C3909CE22128A5157D6ED71BC875DB28C1804FE3F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 f9142ad62069dca0f1172ca44e9f65141249616e8048ba30e7a6d701e7038081
MD5 8dc0baa917b65625cd0984ee1bc682c7
SHA1 c07500064d6368650409d2d34719927913e01824
SHA512 bea6f99aa9f05614019b031a063d8693da3df97b10e52ab5ed1b7b018cb8fb48a79adca33d203d173e4aecea11b70fc12d63a19d399f44665b4c5a1cc6e6bd10
SSDEEP 3072:Uu7sLxK4avMAi/v8XsMjiJpJHHWDjeqC3Qw/xLANk0mUW5GmRntSFCjEEN4:UuUxK4akAMU94VrOk0HOGm/SFyEES
TLSH
T16C1412BD8F1F19B36C6E4563719C2E09CE221189215797E972BCC76DB2886805BE3F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 d8b3842671a24c9ffbf7f1a90ee3edce9e98337d83d87a9d87af01bf07a1e7d4
MD5 eb1c7bb7405c87a2c6f0661e39e98f46
SHA1 f794b885f1849f39d2bda4400c37b86e8cd72918
SHA512 4fc5d73ed57e29e6ae37850aecc5e8c7a71f61d35a43dda3f532b0d9baefaa76dfb3105a332eb23aa27ff6f1299972edd1b99508c6f15a3be1d565e7389ccc35
SSDEEP 3072:xKu7sLxK4avMAi/v8XsMjiJpJHHWDjeqC3Qw/xLANk0mUW5GmRntSFCjEEN4:xKuUxK4akAMU94VrOk0HOGm/SFyEES
TLSH
T1921412BD4E1F19B36CAE496B718C3909CE22128A6157D6ED71BC875DB28C5804FE3F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 9927f8cdb6372edb2d2989943c9d1777f46d6c17f7ff3068553e38218784a0a4
MD5 6442af1301ff9fdff769d0d88225e438
SHA1 1af0bf87705959e614090b736175741a99704ba4
SHA512 6df33610bb2da212c900a0e079ad45f236ba5a31b8e59a89e3693852f06569f9d1a452964fc33e37b29dbc70da1fffb68911d3711e644fa2f7681119ffd1255a
SSDEEP 3072:A8u7sLxK4avMAi/v8XsMjiJpJHHWDjeqC3Qw/xLANk0mUW5GmRntSFCjEEN4:A8uUxK4akAMU94VrOk0HOGm/SFyEES
TLSH
T1DA1412BD8E1F19B36CAE496B718C3909CE22128A5157D6EDB1BC875DB18C5804FE3F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 108cde6b36be7e8cba8eb7f23299177b1348ad39627df0ed470d3b9986c39efc
MD5 5880993ab71f8dc4a601052aa92f1577
SHA1 d47f692ab4f84ca59816b00f1ad01d29c58d16cd
SHA512 fd2d6cba92c0ebca54dd474ae356cdc35f9a1f7f944aa056e113e9cdd6fd65bf63042f0628920da0ef7e04a32b6eb1759e9cad10eeb5ad2c63839bba3c35b1b1
SSDEEP 3072:Lu7sLxK4avMAi/v8XsMjiJpJHHWDjeqC3Qw/xLANk0mUW5GmRntSFCjEEN4:LuUxK4akAMU94VrOk0HOGm/SFyEES
TLSH
T1601412BD8F1F19B36C6E0567719C2E09CE221189215797ED72BC876DB2886805BE3F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 bbf74a6afe6d45c058e270b7004869f8fd0581ba39e3b97ded60a36d3184ed9b
MD5 6ab85c02b438b0a5018a55e2c048fa3c
SHA1 49060b2f0648e1502dbfa76d7a339fe622c15570
SHA512 9bcc7a485e242114ba9799c690e9a1a573d71b038e90fbf2d273e708164a7d9c26bd05cf8517fadc55c34ef83191b17fce31485a635a581995c6e6c9914a16e3
SSDEEP 1536:ip/9cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YW:a93Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T1CA9312BA4E2A46E7997D4A8176AD7909CE12534D705FB9CC315C638C61D01C82F72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

RobloxPlayerInstaller.exe

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
Size 9.5MB
SHA256 2979db026346f0652c943e169ab0b944829a3cf2311b97456f3a15a2d6b7e402
MD5 f76b3613ebb7b9e0224e2d37c8519214
SHA1 d6a1e838221862e5d1156db53d95b8d2c5103de6
SHA512 3ff2c9f26ef85e4122c3a09d8cb99e5bd7fc6d9e6c8afc7624a8d6413090741e7319f5df2e63d6bd45cc78961eef47f75f5454c54795fc040ef4f8d9d0ec8540
SSDEEP 196608:aYEq/UhCY/Kp567NdzDvIDrfyrgcErNYBElBcEFdCK:avVU+Dvarfy0cErNYyr1
TLSH
T154A6CF22F941C031E9D202B2A6BD6FB65D7C9A341B3948C767C45DB845305E33B3AB6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1228-1245-0x0000000001D60000-0x0000000001E43000-memory.dmp

Download

memory/1228-1175-0x0000000001D60000-0x0000000001E43000-memory.dmp

Download

memory/4564-1231-0x000002129B5F0000-0x000002129B5FC000-memory.dmp

Download