381178d3a2ebb0aab4c11d2125f2fa247ffeccc561b4195155901c4b60e3941c

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cloudflare_WARP_2026.3.851.0.msi
Size 129.4MB
Sample260423-jp1v8aev9x
SHA256 381178d3a2ebb0aab4c11d2125f2fa247ffeccc561b4195155901c4b60e3941c
MD5 c23b6c7dd8fb1742999f2a36abe8aa7b
SHA1 77b35a34987810873162e0df52a12da1455be580
SHA512 1dd7d2a97f49fc6f4a24fa9da188023be2f21753c54c4727c5ed959818f3fa93566e49e4414853884ed3273d34a10cdd3215236243cafb8a7a957b1946c1ad05
SSDEEP 3145728:WSBkxCbzSBXWH9T9G24tsljoYppeFPb8llVHvsuwro1WazaDnWb+cLKTWVenX26:WSBB2BA9CW+gVHh5xawVGXh
TLSH
T1C45833DA2111CC6EF5768C3B483D7A5895763DB4962298E303F4B3BA5873AD1E673203
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
90	5436	firefox.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 5 IoCs

pid	Process
3708	Cloudflare WARP.exe
868	warp-svc.exe
3048	Cloudflare WARP.exe
1352	RobloxPlayerInstaller.exe
1680	RobloxPlayerBeta.exe

Loads dropped DLL 18 IoCs

pid	Process
2240	MsiExec.exe
2240	MsiExec.exe
1128	MsiExec.exe
5932	rundll32.exe
5932	rundll32.exe
5932	rundll32.exe
5932	rundll32.exe
5932	rundll32.exe
1128	MsiExec.exe
6096	rundll32.exe
6096	rundll32.exe
6096	rundll32.exe
6096	rundll32.exe
6096	rundll32.exe
2088	MsiExec.exe
868	warp-svc.exe
2240	MsiExec.exe
1680	RobloxPlayerBeta.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4724	msiexec.exe
3	4724	msiexec.exe
4	4724	msiexec.exe
5	4724	msiexec.exe
6	4724	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4620	sc.exe
868	warp-svc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1680	RobloxPlayerBeta.exe
1680	RobloxPlayerBeta.exe
1680	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\fonts\PatrickHand-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\MenuBar\icon_home.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\LuaApp\icons\ic-more-catalog.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\avatar\heads\headA.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\fonts\SourceSansPro-It.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Settings\Players\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\VoiceChat\MicDark\Muted.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\VoiceChat\SpeakerNew\Unmuted80.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\AvatarEditorImages\Stretch\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\StudioSharedUI\KebabMenu.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\InGameMenu\drop_shadow_favorite.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\StudioSharedUI\import.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\scroll-bottom.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-ingame-8x8.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\MotorCursor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\Cursors\Gamepad\PointerOver.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\particles\forcefield_glow_alpha.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\btn_grey.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Gear_dn.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\places\VRFTUX.rbxl	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\LuaApp\graphic\gr-avatar [email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Settings\Help\BButtonDark.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_27.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\LuaApp\graphic\Auth\logo_white_luobu.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\StudioSharedUI\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Controls\xboxRT.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Emotes\Large\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Settings\Radial\Menu.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Lobby\Buttons\glow_nine_slice.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\PurchasePrompt\SingleButtonDown.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\VoiceChat\SpeakerDark\Unmuted0.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\LuaApp\graphic\Auth\ic_aged_rating.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\fonts\RobloxEmoji.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Controls\PlayStationController\PS4\ButtonTouchpad.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_3.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\Controls\DesignSystem\ButtonY.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\avatar\compositing\CompositFullAtlasBaseTexture.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Settings\Slider\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\VoiceChat\SpeakerLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\LuaApp\icons\ic-view-details20x20.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\fonts\families\GrenzeGotisch.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\account_under13.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Controls\PlayStationController\ButtonL3.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\PlatformContent\pc\textures\plastic\normaldetail.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\StudioSharedUI\search.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Emotes\Editor\Large\[email protected]	RobloxPlayerInstaller.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI8DB7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8DB7.tmp-0\Common.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9903.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9903.tmp-0\Common.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9A5C.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF796F38E0B729924D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE6F50755464236ED.TMP	msiexec.exe
File created	C:\Windows\Installer\e5886fe.msi	msiexec.exe
File created	C:\Windows\Installer\{9B7D1F41-A53F-468A-B3A5-B19CFD7DE647}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9F9C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5886fe.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0E8CB974E7C6311D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8DB7.tmp-0\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI8DB7.tmp-0\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9903.tmp-0\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\e588700.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8DB7.tmp-0\Warp.Installer.Actions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9903.tmp-0\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8C9B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8DB7.tmp-0\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DFC872791C1C276E07.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D59.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9B7D1F41-A53F-468A-B3A5-B19CFD7DE647}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8CBB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9903.tmp-0\Warp.Installer.Actions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI9903.tmp-0\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\{9B7D1F41-A53F-468A-B3A5-B19CFD7DE647}\icon.ico	msiexec.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4620	sc.exe
2636	sc.exe
5156	sc.exe
3716	sc.exe
5852	sc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4724	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000611ecaf51c3c1a840000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000611ecaf50000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900611ecaf5000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a611ecaf5000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d611ecaf5000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\URL Protocol	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\SourceList\Media\3 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-0c771458892e42b7"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-2e6461290a3541f5"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-2e6461290a3541f5\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.cloudflare.warp	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\52824FB156B79AC4FAFF7B5B1EEC724B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\ = "URL:com.cloudflare.warp Protocol"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\14F1D7B9F35AA8643B5A1BC9DFD76E74\ProductFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.cloudflare.warp\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\DefaultIcon\ = "\"C:\\Program Files\\Cloudflare\\Cloudflare WARP\\Cloudflare WARP.exe\", 1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\ProductName = "Cloudflare WARP"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\PackageCode = "DC6ECE85D4D467E40BA3ADB091DCE910"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\Version = "436405075"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.cloudflare.warp\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open\command\ = "\"C:\\Program Files\\Cloudflare\\Cloudflare WARP\\Cloudflare WARP.exe\" \"%1\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\52824FB156B79AC4FAFF7B5B1EEC724B\14F1D7B9F35AA8643B5A1BC9DFD76E74	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\SourceList\PackageName = "Cloudflare_WARP_2026.3.851.0.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-2e6461290a3541f5"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\14F1D7B9F35AA8643B5A1BC9DFD76E74	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\ProductIcon = "C:\\Windows\\Installer\\{9B7D1F41-A53F-468A-B3A5-B19CFD7DE647}\\icon.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-2e6461290a3541f5\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-2e6461290a3541f5\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open	msiexec.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A	warp-svc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 0f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd80b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000450043004300000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6514000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a4030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a2000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 0400000001000000100000002edae4397f9c8f37d1709f2617513a8e030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a414000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd6200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6509000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200045004300430000000f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd82000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 19000000010000001000000011a2b3490cb6c379a89e76c3569452d70f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd80b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000450043004300000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6514000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a4030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a0400000001000000100000002edae4397f9c8f37d1709f2617513a8e2000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 5c0000000100000004000000800100000400000001000000100000002edae4397f9c8f37d1709f2617513a8e030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a414000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd6200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6509000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200045004300430000000f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd819000000010000001000000011a2b3490cb6c379a89e76c3569452d72000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3708	Cloudflare WARP.exe
3708	Cloudflare WARP.exe
3048	Cloudflare WARP.exe
3048	Cloudflare WARP.exe
3048	Cloudflare WARP.exe
868	warp-svc.exe
868	warp-svc.exe
868	warp-svc.exe
868	warp-svc.exe
868	warp-svc.exe
868	warp-svc.exe
1352	RobloxPlayerInstaller.exe
1352	RobloxPlayerInstaller.exe
1680	RobloxPlayerBeta.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4724	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4724	msiexec.exe
Token: SeSecurityPrivilege	5060	msiexec.exe
Token: SeCreateTokenPrivilege	4724	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4724	msiexec.exe
Token: SeLockMemoryPrivilege	4724	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4724	msiexec.exe
Token: SeMachineAccountPrivilege	4724	msiexec.exe
Token: SeTcbPrivilege	4724	msiexec.exe
Token: SeSecurityPrivilege	4724	msiexec.exe
Token: SeTakeOwnershipPrivilege	4724	msiexec.exe
Token: SeLoadDriverPrivilege	4724	msiexec.exe
Token: SeSystemProfilePrivilege	4724	msiexec.exe
Token: SeSystemtimePrivilege	4724	msiexec.exe
Token: SeProfSingleProcessPrivilege	4724	msiexec.exe
Token: SeIncBasePriorityPrivilege	4724	msiexec.exe
Token: SeCreatePagefilePrivilege	4724	msiexec.exe
Token: SeCreatePermanentPrivilege	4724	msiexec.exe
Token: SeBackupPrivilege	4724	msiexec.exe
Token: SeRestorePrivilege	4724	msiexec.exe
Token: SeShutdownPrivilege	4724	msiexec.exe
Token: SeDebugPrivilege	4724	msiexec.exe
Token: SeAuditPrivilege	4724	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4724	msiexec.exe
Token: SeChangeNotifyPrivilege	4724	msiexec.exe
Token: SeRemoteShutdownPrivilege	4724	msiexec.exe
Token: SeUndockPrivilege	4724	msiexec.exe
Token: SeSyncAgentPrivilege	4724	msiexec.exe
Token: SeEnableDelegationPrivilege	4724	msiexec.exe
Token: SeManageVolumePrivilege	4724	msiexec.exe
Token: SeImpersonatePrivilege	4724	msiexec.exe
Token: SeCreateGlobalPrivilege	4724	msiexec.exe
Token: SeBackupPrivilege	4956	vssvc.exe
Token: SeRestorePrivilege	4956	vssvc.exe
Token: SeAuditPrivilege	4956	vssvc.exe
Token: SeBackupPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeBackupPrivilege	3412	srtasks.exe
Token: SeRestorePrivilege	3412	srtasks.exe
Token: SeSecurityPrivilege	3412	srtasks.exe
Token: SeTakeOwnershipPrivilege	3412	srtasks.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeBackupPrivilege	3412	srtasks.exe
Token: SeRestorePrivilege	3412	srtasks.exe
Token: SeSecurityPrivilege	3412	srtasks.exe
Token: SeTakeOwnershipPrivilege	3412	srtasks.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe
Token: SeTakeOwnershipPrivilege	5060	msiexec.exe
Token: SeRestorePrivilege	5060	msiexec.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
4724	msiexec.exe
4724	msiexec.exe
5436	firefox.exe
5436	firefox.exe
5436	firefox.exe
5436	firefox.exe
5436	firefox.exe
5436	firefox.exe
5436	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
5436	firefox.exe
5436	firefox.exe
5436	firefox.exe
5436	firefox.exe
5436	firefox.exe
5436	firefox.exe
5436	firefox.exe
5436	firefox.exe
5436	firefox.exe
5436	firefox.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 3412	5060	msiexec.exe	82
PID 5060 wrote to memory of 2240	5060	msiexec.exe	84
PID 5060 wrote to memory of 1128	5060	msiexec.exe	85
PID 1128 wrote to memory of 5932	1128	MsiExec.exe	86
PID 1128 wrote to memory of 6096	1128	MsiExec.exe	87
PID 6096 wrote to memory of 4620	6096	rundll32.exe	88
PID 6096 wrote to memory of 2636	6096	rundll32.exe	90
PID 6096 wrote to memory of 5156	6096	rundll32.exe	92
PID 6096 wrote to memory of 3716	6096	rundll32.exe	94
PID 6096 wrote to memory of 5852	6096	rundll32.exe	96
PID 5060 wrote to memory of 2088	5060	msiexec.exe	98
PID 5060 wrote to memory of 3048	5060	msiexec.exe	104
PID 5536 wrote to memory of 5436	5536	firefox.exe	106
PID 5536 wrote to memory of 5436	5536	firefox.exe	106
PID 5436 wrote to memory of 4676	5436	firefox.exe	107
PID 5436 wrote to memory of 4676	5436	firefox.exe	107
PID 5436 wrote to memory of 4676	5436	firefox.exe	107
PID 5436 wrote to memory of 4220	5436	firefox.exe	108
PID 5436 wrote to memory of 4220	5436	firefox.exe	108
PID 5436 wrote to memory of 4220	5436	firefox.exe	108
PID 5436 wrote to memory of 4220	5436	firefox.exe	108
PID 5436 wrote to memory of 1272	5436	firefox.exe	109
PID 5436 wrote to memory of 1272	5436	firefox.exe	109
PID 5436 wrote to memory of 1272	5436	firefox.exe	109
PID 5436 wrote to memory of 1272	5436	firefox.exe	109
PID 5436 wrote to memory of 1260	5436	firefox.exe	110
PID 5436 wrote to memory of 1260	5436	firefox.exe	110
PID 5436 wrote to memory of 1260	5436	firefox.exe	110
PID 5436 wrote to memory of 2004	5436	firefox.exe	111
PID 5436 wrote to memory of 2004	5436	firefox.exe	111
PID 5436 wrote to memory of 2004	5436	firefox.exe	111
PID 5436 wrote to memory of 2004	5436	firefox.exe	111
PID 5436 wrote to memory of 2240	5436	firefox.exe	112
PID 5436 wrote to memory of 2240	5436	firefox.exe	112
PID 5436 wrote to memory of 2240	5436	firefox.exe	112
PID 5436 wrote to memory of 2240	5436	firefox.exe	112
PID 5436 wrote to memory of 1452	5436	firefox.exe	113
PID 5436 wrote to memory of 1452	5436	firefox.exe	113
PID 5436 wrote to memory of 1452	5436	firefox.exe	113
PID 5436 wrote to memory of 1452	5436	firefox.exe	113
PID 5436 wrote to memory of 1412	5436	firefox.exe	114
PID 5436 wrote to memory of 1412	5436	firefox.exe	114
PID 5436 wrote to memory of 1412	5436	firefox.exe	114
PID 5436 wrote to memory of 1412	5436	firefox.exe	114
PID 5436 wrote to memory of 3148	5436	firefox.exe	115
PID 5436 wrote to memory of 3148	5436	firefox.exe	115
PID 5436 wrote to memory of 3148	5436	firefox.exe	115
PID 5436 wrote to memory of 3148	5436	firefox.exe	115
PID 5436 wrote to memory of 776	5436	firefox.exe	116
PID 5436 wrote to memory of 776	5436	firefox.exe	116
PID 5436 wrote to memory of 776	5436	firefox.exe	116
PID 5436 wrote to memory of 776	5436	firefox.exe	116
PID 5436 wrote to memory of 5568	5436	firefox.exe	117
PID 5436 wrote to memory of 5568	5436	firefox.exe	117
PID 5436 wrote to memory of 5568	5436	firefox.exe	117
PID 5436 wrote to memory of 5568	5436	firefox.exe	117
PID 5436 wrote to memory of 1352	5436	firefox.exe	118
PID 1352 wrote to memory of 1680	1352	RobloxPlayerInstaller.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Cloudflare_WARP_2026.3.851.0.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4724

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3412
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 76FAA76CDDFC6B2AB0C0536DE803D11E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2240
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 0AA6CD96409F7D084F01463E00829923 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI8DB7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240684500 25 Warp.Installer.Actions!Warp.Installer.Actions.CustomActions.ReadCmdLineParams
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:5932
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI9903.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240687375 36 Warp.Installer.Actions!Warp.Installer.Actions.CustomActions.InstallService
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:6096
  - - C:\Windows\system32\sc.exe
      "sc.exe" create CloudflareWARP binPath= "\"C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe"\" displayname= "Cloudflare WARP" start= "auto"
      4⤵
      Network Service Discovery
      Launches sc.exe
      PID:4620
  - - C:\Windows\system32\sc.exe
      "sc.exe" config CloudflareWARP depend= "wlansvc"
      4⤵
      Launches sc.exe
      PID:2636
  - - C:\Windows\system32\sc.exe
      "sc.exe" failure CloudflareWARP reset= 86400 actions= restart/0/restart/1000/restart/5000
      4⤵
      Launches sc.exe
      PID:5156
  - - C:\Windows\system32\sc.exe
      "sc.exe" failureflag CloudflareWARP 1
      4⤵
      Launches sc.exe
      PID:3716
  - - C:\Windows\system32\sc.exe
      "sc.exe" config CloudflareWARP start=AUTO
      4⤵
      Launches sc.exe
      PID:5852
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 35A629F4D756C19B3CAD6FA16225A98C E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2088
- C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
  "C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3048

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4956

C:\PROGRA~1\CLOUDF~1\CLOUDF~1\Cloudflare WARP.exe
C:\PROGRA~1\CLOUDF~1\CLOUDF~1\CLOUDF~1.EXE
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3708

C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe
"C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Network Service Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:868

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5536
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27097 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {bd7646c7-cd0a-4a49-8f22-466e1e90b7e3} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2424 -initialChannelId {853c12c7-b48b-438e-8cc8-8c812b6c5338} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3820 -prefsLen 27274 -prefMapHandle 3824 -prefMapSize 270279 -jsInitHandle 3828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3836 -initialChannelId {86766f81-8693-46f9-8c04-4b09787cbc3f} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:1272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3972 -prefsLen 27274 -prefMapHandle 3976 -prefMapSize 270279 -ipcHandle 4060 -initialChannelId {f6d598e1-4234-44a4-a2f2-71afc72fc9c0} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3184 -prefsLen 34773 -prefMapHandle 2980 -prefMapSize 270279 -jsInitHandle 3124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3088 -initialChannelId {44fdc4fa-9334-4450-9cfa-a7afa142dcd6} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4912 -prefsLen 35010 -prefMapHandle 4968 -prefMapSize 270279 -ipcHandle 4976 -initialChannelId {17c94af8-123e-46c4-92b3-58007a0c35ef} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5592 -prefsLen 32952 -prefMapHandle 5596 -prefMapSize 270279 -jsInitHandle 5600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5608 -initialChannelId {1d0a440e-87b1-412c-a42f-2156086a4d3f} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:1452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5660 -prefsLen 32952 -prefMapHandle 5664 -prefMapSize 270279 -jsInitHandle 5668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5676 -initialChannelId {48afe4d7-b70b-4a03-b9a5-875309b77fa3} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5848 -prefsLen 32952 -prefMapHandle 5852 -prefMapSize 270279 -jsInitHandle 5856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5864 -initialChannelId {ad2e1f90-4025-4e03-9101-cd493ab07b71} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6220 -prefsLen 33071 -prefMapHandle 6224 -prefMapSize 270279 -jsInitHandle 6228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6236 -initialChannelId {afb59049-3763-4145-af71-1fd65b600f25} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6564 -prefsLen 33071 -prefMapHandle 6656 -prefMapSize 270279 -jsInitHandle 6660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6644 -initialChannelId {66c9a76e-f927-4836-a547-2886e62789d7} -parentPid 5436 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5436" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5568
- - C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
    "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1352
  - - C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\RobloxPlayerBeta.exe
      "C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 1352
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:1680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5886ff.rbs

Path C:\Config.Msi\e5886ff.rbs
Size 162KB
SHA256 e15d5b342f9068906a7f27ba6b88ee9b63cf5d2c6590fb5ac8da755bb1ded81f
MD5 aed1ce14c7d8e2779bc86c23ff75a84e
SHA1 b0bf0aa7bcc5dc2786fe4a2338da4378dedd71ec
SHA512 3e3f2bb75a5e3ee6af9dcbf6e3eeba39231569bedbca6490af9f816bddf464af957ad7820ff58019304a1d0a062eb7eca7074f5fd2bd00634e3c47d1139b59ab
SSDEEP 3072:ZBJdLyE16iOLin7Q4RZUKnnH1uhC7vu/2nrZ/yqMPuT:zJdLT1jXZ/H1dRxtT
TLSH
T18EF3AF0171D080B2EABF19355520DB722F7FBA609B508A9B439D8A7D9E702C09F75B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxStudioInstaller.exe

Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.4MB
SHA256 08fa8ed4fbdd8434832d198ef981ec953a719dd7abb2d6ea0c2985d57c542089
MD5 2b68d224d3ae3760a24cb64b66c2de3e
SHA1 00fac07a9904e10e7ee39e025bbc89b2aa8259b3
SHA512 4ab3153e59baec2e088fe14ee902f14de69f26f6f9dc9036d0add7d1070236bce441f0553bd5961ebad0416f6beb33976a5a484589a4f9f0675dae900e131a8a
SSDEEP 196608:k/obnhP/XRX2H2B1RAjCq4IvzExFL+TABhDMQT0:kuVBXvAeJmzExFL+iwQg
TLSH
T137A6BE22B940C021E9D202B2A6FDAFB65D7C9A341B7944C767C45DBD45305E33B3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\RobloxPlayerBeta.dll
Size 15.4MB
SHA256 f937e00724f5ed12a0b662e2b4b07ec1f61a6204a34fe047f3b57530a730d9fe
MD5 580a2caefc86d689058d908dd6b07a36
SHA1 8b36c73d63e7fbf9fe8122c5a293597fbc3dc270
SHA512 b5a0fc7bb6436e4a57b3f0e97a469a1fa023738a13a6954541c2ea872a1c47b13a7b3abc2546d447b56699a53874b724577f4f15bf2d0098833337cfda6255c8
SSDEEP 98304:+M/piZg8dlnAC+YnbQMSTETspSgI4qB+xRmc/hyR9fDx/MEJ2mKzZec8DSbpR4SH:+M/pQlEyv/MEJ2jenD+R4S7OuK
TLSH
T133F6D04FB5E24C28E1729079903F33D7DA16718C4A186AF343D952503A7278D6A2DFAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aws_lc_fips_0_13_7_crypto.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\aws_lc_fips_0_13_7_crypto.dll
Size 2.1MB
SHA256 e4a10a4411012dd93432f650e55cd8a5cabd7ec29efa6a568b50b24ebdb1e399
MD5 b9f5744a5bac8d33810e4c1656d09c71
SHA1 dc8eb1eff7eb1be58851a6b04938ededfb98bc25
SHA512 bcd7881d1f7ed0e1e8d6dd1f22dd21e2f4dbd16f2573118f7d613563bfa90bf2bc4dcd42ea0472aaf9f5240e211504a1b75d2ada84b62ad0208f3ad5cfa17452
SSDEEP 49152:7VwASOS2e4ysGJWO3z3iwGIVCDlEsidhwfxbUZHIU6iZ:Sm3trJ+o+Z
TLSH
T1BCA59D95A2B404E4D8B6E239CB53653BD27034198374FBEF07B047A92E53BEA553E702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

616AD1AB067CFD351D6C0EF6F3E12F40

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\616AD1AB067CFD351D6C0EF6F3E12F40
Size 1KB
SHA256 57062dcb0dc6ff74d69a36fd7f888266bf986749df2ffc957bcd36017eeb8f03
MD5 15dbb1cbd122a9acaa7070d67df97a48
SHA1 cadd64cb4aa6ae31109a067fde3b1398c22c9161
SHA512 e434f008b7fc2f0662a48b1c57cf4021b3433a1f1ad73b3e7aa1d28f99a36b4354c6bc1a8e3e7cc665c148827c7ed6f48ae0c2e479b8080b565f80fa681287b5
TLSH
T17711205A0054362396092E70EDCADC679DF1A78A02C1C80BDB50C5C55A22FC82F995F9
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_2D249A1547B2300A3D78D6658366FC30

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_2D249A1547B2300A3D78D6658366FC30
Size 727B
SHA256 00a2bdaaaa10ae908b2556cc8af77c2bbc366e2b4a95155d034310d44067e9f9
MD5 3b75c9bcee2ae4a3af86a957c8d26d8d
SHA1 87d4f80854f7a8fffef481de5d973f519a1dda02
SHA512 57f6ca593fea5a36f0e0966c9b803302c516ff3a6ab5da850ebf5c6ba71900133d850f0d33860d7cc5a772aba9cf021b1f6c89759b6e138217a92b47aa93280c
TLSH
T18F014442183425C4BD7A0E394E9C1EA7BB039112954501BB903B1147B4A1761FDA3734
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 d94ca0fd355aa72923fc9a664ecc97b5aeda9b3ddd73fdac3e56de696e7ca9f2
MD5 4646e06bb4c9250d80cf96bdec336508
SHA1 4604dc1f9de0f1a6717720c9e234f91bafc57cea
SHA512 802e463fb83a1f5a97f0fa22219ebf272874d327e5cc57bba9aec471df986a6efde1e79f1fb6f1299b2d19fbfe6f596bee2a9860283877893553c87c165da753
TLSH
T14201447F58BCDF507C204540A45C86FA3BFAD3C528C20B5F167560BE21DE159161B372
MD5 SHA1 SHA512 TLSH

Submit Download

616AD1AB067CFD351D6C0EF6F3E12F40

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\616AD1AB067CFD351D6C0EF6F3E12F40
Size 252B
SHA256 17772aacddb14c4332a91cd0abe5cba860704d49ca630d9e9dce64326a6f08f2
MD5 2ef1b46108a769d3d6b50e092d06afb6
SHA1 5205132d0d769bbdec7387b5648e5ef49442bb1f
SHA512 86067b65578c766954e06563600f5772a758de6ddc8c674ddbd0d8e6ff9532109d4969fbeb4f2b7cff04920ea2f17ffd79f40097ecf17445d1bafd8baa30eb18
TLSH
T15AD0C71067E40236F5551A395EF14782E738B5257452CB5942D205D954A4F91486160B
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_2D249A1547B2300A3D78D6658366FC30

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_2D249A1547B2300A3D78D6658366FC30
Size 404B
SHA256 fafdb244fa5f108c3c95a4b7e3c881306051d4127c6a449715057cbe8ccd08d5
MD5 4bade2bdb483bfa0be7c348b094030d5
SHA1 f20beaddcb10ec1649b05c52c0e00430e95b2159
SHA512 5e975a52f0b59c4e037586f98eacd596e84577865f57c36a523eb628e604a36adce6ffa4efeb2e27c558d2f6a2d655255d7e3d842dbb8a9aa607d4b97509e5c0
TLSH
T139E0C63432FA425DF1F8913846FA9C267A6DF20318699A6A20C06782BA12B800CE1634
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 17e0443e3bfcd645311fb887ee8f1fe69e8e911b044963c88b415af5c35a60ef
MD5 dac25a0624703309aa750a727c1bf577
SHA1 5f056ba284444c4eb44983324aaad1481d502a07
SHA512 ee3c68849d94572edebf8ec8c5e15ebd6999b129065d16d5d5747378d5649715468a3db248200350b474e30a4cf2ce7c6b6f6d4633750d389f8b88488c02846f
TLSH
T167E0C03812EFA15EF260DD3141FDF2711E48F302644493B915D10308B713F004C14AF5
MD5 SHA1 SHA512 TLSH

Submit Download

gui.second.log

Path C:\Users\Admin\AppData\Local\Cloudflare\gui.second.log
Size 99B
SHA256 6989b3c9f91a39cd6dc7a8c43ecceba7fb1ff3d738b49ce17dc0c72a641ca0da
MD5 795e8152f3012c29dd697b327c488449
SHA1 9b6fab96958c1c1e53b2d3a625d35792771f4a2b
SHA512 2b1a0ddb927da645c56e5e9dbf4c235ef97ab14f8cf45b1071f75766858b1adac19e725eb5f29304f23479d0f939b61256715570320c2650e2de90f97b0612ee
TLSH
T173B012080B7004726B374250D11118C8C7023000900A05E1E3B792430523E92CCCD10E
MD5 SHA1 SHA512 TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log
Size 737B
SHA256 91bd0c4dba211dd55e17ff59e8396ac3893c51ca80d041e310874f90b89520d5
MD5 3d0e9d9478a1da557553a6f9f6998362
SHA1 e79897bb4d6fbb16c530eecf5819decd13f7baf0
SHA512 bd9b8410045e1d23caa45a1c6a11e495c13b55659dfef73b490222485ee35fc66d74aa04e8ceb4b665a238cfe64791a51b4a218891698fc6d91d9e8a438aad22
TLSH
T1BA017B713361B1D449162F03184C66895BFF43186A54AD4CB9A9724EE82D05BAB223F3
MD5 SHA1 SHA512 TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 9991b0899123dbdac0482c11c163fb2692e002924ff179596e5a226608067d7c
MD5 baba7eb614b308de62b37f7eab41d131
SHA1 81f9bb4897acf73ea1b82ac87cf595ccebdc47d4
SHA512 82b8c7eb1f28f87d819a6855039d17fb2bff8497f39025f2630cf8f3ac890ddabe24fa53ca05fa41cce03297713f50a5b08b27725ea34fdecfb17aefb60318f0
SSDEEP 384:HbaFrLiO024YlFuhw+5EL1pPsac4j0lpDII+Q4C:7aAZYlFuK+5EB9sac4ID8LC
TLSH
T139527D7E9F0138BA1A6BD294D8EA5205CE04D6BBEFE3D16605143844C6843BDB8F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI80616.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSI80616.LOG
Size 36KB
SHA256 5ee411dd210d53f2e586464527042678d125970f4d6d53a8a513ca0cb8a019bf
MD5 59a55c8bb985882bd8e02e1a1beaf818
SHA1 eff8197d8ced8ca0ec6aed3e02262cf176a9ef4e
SHA512 8a62d739e3eec978ea78e64f85b34c5b9a3c7cdb6fce70940f8ea4c5c4e6f073aa537177ff6de51529b2bd2b2af3c152bfd1cfd9bfb75a83b5ec2825b6b76534
SSDEEP 768:Slqe8QgyN2uLYZDVuZ25SLHrATsg3/i3US7WL3X2rC3SY2drGCCuc/c8c9ScLI7t:Saw+/jE9RrSL+1LRUKnA4vTs4hec00CJ
TLSH
T15D03043A2FE4010DB2B7E643DFF744559A73BD5A6935C90D6082C21D44B2E05AAFC3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\AlternateServices.bin
Size 13KB
SHA256 d82abb97bb8c670676310b942fee1c7b3de13b44484de48f095d4505e43f88ed
MD5 4fe2212f089d75d1fd002a6a791ca781
SHA1 e8f3f510f63e9d3059b8506ee648bd202e0c5acf
SHA512 13ddc957a4fef59858f726206121ac71421ec9619f6455774f34a47b1531c6e0bc8f82eb8b0212833ea0698f01de4c75d49d9fef772d241f63d15d0dbd2dc3e0
SSDEEP 48:UF+2i6ON0BI56BKB+dl2NV9IlyM/ppe4:UF+2i6q0BI56BKB+dlqV+lyM/ppe4
TLSH
T1445243F36B7668A2F0938FF28058B94D9C33033955AD9184C75490F75AD2B99903EFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\AlternateServices.bin
Size 10KB
SHA256 9fc7cdb7be18aa5d5bdfb9f7f2ee468cd11fc51820aaa679e8cb0b7697b329b7
MD5 b61ba1633138d7b3c2f33bcad8cc8fab
SHA1 ade49717ded61390356cf6c1d91bb736b8ca7902
SHA512 8221919539d5e86bdac9c736239310f7ed9f1a3778e95b301fb4b0b43eb2d706e791bed3de7e36ad5281a72630ace15927f6770600622b29f0c1272652de9098
SSDEEP 24:tuhMZGoo91DI9xBmg9BlmA9FTmf5q9F55A5mmI9VvXm89l/m:4tC+qKKEhI569CB2uA
TLSH
T1B02283F76B72B872F0928FF18058FA4C9C33033925AD9185C75484F75AC1B99913AFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 7f1689a44ae3b701bdbe5379b0d1bfa47777bfe525163484872b7f24d11a91ff
MD5 f92f44e2a6b14b34fad3a388e3cc7f00
SHA1 b1cfbb2283297401700e884fedd65d31a4173c70
SHA512 16210a2716e7c38c95bbfcc92fbaed72061bea62e3ae52db700b96b7c733caf8c383c72ff9cb825ae23cd82e0e8daa743bdea1760cb0b53edad1a68c7325ddad
SSDEEP 192:K1d66Joz0dzgCl6mc0dZ7Ov5zboHnb3hyjfxI:0d66JozQzgC1j4boHb3hyj+
TLSH
T136D1EC64F6294A3BD419023BCCB61F500F35394AA88E3F1932EC745D2D562DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f0654759fb0a81452e3f08c466dafa63eb5ad3c3a100fe8aa4f9bc4ed6371575
MD5 eabfc0e99717665131b1c989315ebfed
SHA1 40bf41522b008833c4f76db18a755bfaa0fa262d
SHA512 edd9d74e4dafb8c49bfcbf54384e32cf86ec8424fe2b214a076d0217ceb671ab0e7ea52b82138252f702f40eb7d4adbb9f319140d6d03e8296801b1b98bb5303
SSDEEP 192:K1d66Joz0dzgCl6mc0dH7Ov5zboHnZ3hyjHyL:0d66JozQzgC1jOboHZ3hyjy
TLSH
T18BE11D64E629463BD409037BCCA62F500F39394AD84E3F1936DC645C2D5B2DD3A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\events\events
Size 5KB
SHA256 9a4c8ada30b0a10490ad805c89ca83bd0d56e2c9f6cde0bb59d4ebd30f8acdbf
MD5 4673be0b6dd4e8d9959829182a29b269
SHA1 661a6e910175e4284c5c62de14fef0c0b4883711
SHA512 ffc3b23cd4bc168cf3536205c3a6488debba6d6bc1385293a1b315a4e248a841895f925d5a1f079b73d6610b5115c9379d4647f72f2597f62641c6816dd6d2ad
SSDEEP 96:Jh+LR4Wyofo4y/c/d9oKdYXVubPBpEA3chWafge1h:8gS9osYXVqpeMwx1h
TLSH
T1ECB1FF2C75A90CBE78DBD2DEB8410B8E52D9470794C71C478D87DE48CC8AA9E321F979
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 016c711f34ed7cce48be3164089364c416f153210162bd1f86e8a1eb90da1268
MD5 01418c1b7bc590ab3c0c7a80cab018c4
SHA1 339f7f546f7c96713443034c7361697d6b079dbb
SHA512 25b7bba5f4cec27c0ae67aabd8889eb25a62dfb5180ee49b6fb804a6578a830546cd1f8179a4ebde9766b6ab861e8b3ff610fe1383a7defa6c37fd9868f7731f
TLSH
T190216D5C36F84DAE689BE2AD74510B8F63914F0B14871C434E42DE8CDC85AD9316A838
MD5 SHA1 SHA512 TLSH

Submit Download

161bb66a-b49b-4fd3-84ec-9f6d23a0a601

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\161bb66a-b49b-4fd3-84ec-9f6d23a0a601
Size 235B
SHA256 b4a28e8f8ad18855393446fe8151a5bf73c94a51a5253cf4913cef66d991b270
MD5 2a4186cb42e66dcd81e7090bfa1b6657
SHA1 12e26e8f717db5baee21adbd4c947acf305d5758
SHA512 0a5138606d3626507b8cf29d6b1e17c34b027de9d5b263cc04e1f689d51430fc979ef97fd0c70a7498e3a289f37b4a3792c6d8cc411e5e10b9f6ba353d544c1e
TLSH
T1D1D097801498B36E08204F02F0E029E632948C3B18A0A820D56104B89DBCEC44313C06
MD5 SHA1 SHA512 TLSH

Submit Download

3690f815-2f0e-49ab-983f-06c9d690a070

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\3690f815-2f0e-49ab-983f-06c9d690a070
Size 886B
SHA256 23330decd43b3b422e7130539761243c5700dc9b3593bafd5b9914603ff92a77
MD5 7287e52635601c685aa7d35586b76806
SHA1 f9083ad1ae799b277e377b0b03eb10cfe0642176
SHA512 a1c39e61223fcc6058b30720c85f4e4535daab8269d382f8dc26a0df1151e91f073723373d09606a80a86df3e1b60b220c44f091e1664622d48ede2bab262c5e
TLSH
T1BC11008196317CF29C7C939B95B17B5247E47523C0C909183E909E180EAA16EA766717
MD5 SHA1 SHA512 TLSH

Submit Download

a100b158-f5a7-41e5-af91-c252e423220e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\a100b158-f5a7-41e5-af91-c252e423220e
Size 235B
SHA256 0135db82ad7331bef7f4a9784a14af00a1cf182b37c72816a0b309090a5cb0a0
MD5 5bf8d8e95dff3207c3cb65e30adaa99a
SHA1 1d687fd5f6ee5748d24808b4f600db50399134d6
SHA512 f12617a2d3b1d52669994b315cc5e7995ad2af84d136e3992f266a35379296e4d07ee29cdf92f27bdfab3ca035152c3342c443d12e05fd2a8016f01d45b0da37
TLSH
T180D097C4288863AE08286F07B0E06CC631844C332870A86099B002B8DBFCDC80171856
MD5 SHA1 SHA512 TLSH

Submit Download

a76e590b-a475-4a38-be6c-0b9a1f22b83b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\a76e590b-a475-4a38-be6c-0b9a1f22b83b
Size 2KB
SHA256 5c882d918ab0453f0be81ee77d7abde8b729d1de1c4419fdc8a310a3d20689bb
MD5 d4b33384ba56128f91db68cf82b56d7b
SHA1 abe6c7d65daca858a2e6519ec56116ce158a2319
SHA512 fbcf09f15937391781f04a6781a839b47745e8ca82edc5e96bd90076dfa7f374404ad0210d7d23772cf1314ec7ad5485d0df111e4308c7e77d9f81888d3b4d65
TLSH
T16641231835785C7A9CCAF65D9882338E53A04A1250C619833E51EE4C8D966DA736B52B
MD5 SHA1 SHA512 TLSH

Submit Download

dd7f13a6-b257-4395-81de-cc72dc82dbb1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\dd7f13a6-b257-4395-81de-cc72dc82dbb1
Size 16KB
SHA256 ece92369fd063406675faaac58dbc3bcb258db30a196aa8df1667c75a65a13ba
MD5 6a96f8f495aefa23be9b02efe4fd0829
SHA1 f365a0f7e5261aac6a389590c2c05c756aa9c205
SHA512 fcf233e4c629dc669b59a7a909511aa9ef505a6b50fe1142a6f0a21511b44ed693f2aa34ef83dc27a556fcb8d9dc132f6a1dc7be15b1ce841c0a18ea48243b31
SSDEEP 192:+ymC8BX7kSSzxuRic3LLQoWEJBSFeyf5F54YDflp95ChhdZBBpLcHhaHn60DN090:+NCwXSluRic34oWgGfpMHDO9YmW
TLSH
T17B72B816186049BA8251E36894FCBFC3E6F528CF4C418FCA9BE4BD4869EE06D512784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eff7a6f9-2a66-4d2c-aba1-369be5c55f37

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\eff7a6f9-2a66-4d2c-aba1-369be5c55f37
Size 883B
SHA256 62829333f39f8a11fb207d232a7b96d272be75299e93a8822332808f4984be9a
MD5 c2d667e8914bc711640ae21376e9e8a2
SHA1 7a6241d2db44ab4763662127d8c0bc14d5b65d54
SHA512 5660fc75ae03dfad1cc6ec65f4a3eb0b0933813f0dff7a5488fcfbf1a378490a574b2160ec9154e8350f2289fcc9d85189f92eab053ec8d836372bc1443d188c
TLSH
T10811DC41963178E2DC6C934B89A13B5257E4752380C544143FA59E080E7E66AE35A25B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\extensions.json
Size 16KB
SHA256 f08c37effb14eaaba68cdbaddcdecf2c313d405b9473888c812cc4398d6f8616
MD5 5e91191e1bb638c3d6c9968edea05004
SHA1 a024daa74026328a1bb8fbe04fcf364939b2d136
SHA512 e4384643a166c35f7548388d5907211769b24f8ed64ed5b87b7f6318f38680c7bf7c45d3475f2163511dd79d910c1c702a7e64cf6f08e7272d3351883e72e626
SSDEEP 384:CkI4vDUmldvG8dhWa94zY96oRL4H5L4P1L4HtQL4HVL4HmH4hW:1I47RfrXX4Y6y4R494NS414U4g
TLSH
T13A72531545048EB8298FA79BAA367E01C37D433B60855C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs-1.js
Size 6KB
SHA256 6d4d5d3945a812610c62ad29871cde8baecab9013d52d0ebe2521a09195628e6
MD5 a8f791d70e04b97f70b13c4a7e0ecb0c
SHA1 135662970a1d5bcb32c39cb688d741f795b26d44
SHA512 a940d6073e7b89de6b4794b10d89f96676a2d735d8313f5b5a1e4da143fbba136a4b8c9fd34527dffca4ec9fed170db2d76105ec55a7e8f62b65053b0d619a9a
SSDEEP 96:xHiUTUAPqGqcUfCkY1zSeSSlrdv9j8nHHCriDYzMgBw88H8L4cnHVjkGS:UwCRvfCkYPSS6CaYzMgBw88qM
TLSH
T170E11E7890088B7F74B677AC6C688C316AB2413BB7BF68C750B95484055CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs-1.js
Size 8KB
SHA256 971645a46f2b136101ece9834cdf8c41c3c726b2c649fc730060faa2c40fb5cd
MD5 899067697a7a6472c3e8708de74eb07f
SHA1 584e09caa269d22aa6c7de55d81c089b87872eba
SHA512 9680da75878a47cbc14bd50542d068587287c9df09fee15619ca18b5ecf4258a0b2aaa9e1d4e31a2a5282d09cb1c1cb8624938f5ff4a4a487e65a8ed4830cce4
SSDEEP 96:xHidTUACPqGqcUfIkYNbzSeSSlrdv9j8nHHCriDYzMABw88Zuc8L4cnHVDkGS:UXCCRvfIkYzSS6CaYzMABw88ZuL8
TLSH
T15A02EC3851048B7F74B637ADAC684D716A62023BB6BF68D251F95484094CF3841FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs-1.js
Size 7KB
SHA256 b93837988598397d5cfdbea727ef329f5d0296c3ea057459f06a56217e6e9bb6
MD5 b6763a0b937a590dca34e77aaa90bd0f
SHA1 cee6173cde10a0128a983ec1e60d2046d85aa3dc
SHA512 e7832ff2d773e5ffcd6a519287f5f42c901cb4acb5714e11555340a738ba4bca03edad38d3aadc44e7ebce57aec7234ea458207a090f8f77e144363c85a5c5d0
SSDEEP 96:xHidTUACPqGqcUfCkYNbzSeSSlrdv9j8nHHCriDYzMgBw88M8L4cnHVDkGS:UXCCRvfCkYzSS6CaYzMgBw88b8
TLSH
T19FF10D3851048B7F74B677BCAC684D716A72023BB6BF68C650B94484055CF3841FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 7924e3e5ef3ff388f8c82d623b682ae68d1fb5df04c8f51fdd5364bbf1f2f127
MD5 1b393d4a26f1d89a95fb2772c67c23d8
SHA1 600480ca401d593ac1dd0446751ad40fb1549d57
SHA512 760c16e5d275597b6c9fb0b74d8a9d03469c73438d64e4326e611542e20e48fa7c22a7984ccaaad91cf166beae59ca59504b9f1aaaca84c69c598d1afe9ccabe
SSDEEP 192:Vd0f39/Zdci/sU4ZujvNZ1YNY2hPhKeZpxVdFj2/6:T0fOWd46z1YRhZKeZF2/6
TLSH
T1B502B003F3A35E62EBD7D6824CCF677A65CB4C5A87B50DCCEC09F2018AE596980352C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 b742ee6c3918dc65beb2eb86deb0c8b43f4a3c65842c86357bcdf276e6d68884
MD5 6365fbbe53fb0eb30a29654135e26677
SHA1 7b35a735c44ac2103b6cbfa3828130061626cd9c
SHA512 e0b92647e80fac83ccedbecc953ebd8e327962f612d0838e5eb818fb061117c38eb678789ade7cc2fa5d64751de4e75ca16de7687d0b4b1fd992492f4c2c5814
TLSH
T13E713B83D8DB5DE6DA87A153E4C6D3D5BD470869832018D8DD41B7008B4C2FEA2FE789
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionstore-backups\recovery.baklz4
Size 8KB
SHA256 a44b92f0ac0496a9908f3d8d9e1f283dfa643429b1227b608eb3d7f312c715f9
MD5 4b7da9e959e39d161ae9dbc65b12bb68
SHA1 1d3cb13c67d31cfe635e4483dcda956e8737e1ac
SHA512 aeef3120af6a172080450ec05088bf8b61baef3dd613a8cd289bce36295b050a3a734033ce1a394dc82f2a4326913363e9e210a91a034ba940c78b6829ed9d87
SSDEEP 192:od0f39/Zdci/sU4ZujvNZ1YNc2hPhKeZpxVdFjg:y0fOWd46z1YhhZKeZFg
TLSH
T14702B043F3A25E62ABD796C14CDE277965C74C5A87B50D8CEC0DF2018AE5D5D80352C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usage

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\storage\default\https+++www.roblox.com\ls\usage
Size 12B
SHA256 ad54a3667e6a1aac8df52666aea3924b51188f8657330863544f3fd880bc85e5
MD5 789377b4252d60587fc33e12da5e3bfb
SHA1 ccb250aae1bb5c64106864212475a20b6788d8d1
SHA512 d4ec58668c50a79653034cacdd1c163a5b1e053ee0b929fda01adaf1b0d1ea55179ea9f11cffae38caa8bddf542a4b55c6d19259f8e949001f5a92bc88c2c3ac
MD5 SHA1 SHA512

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 98328da41891f8a84c9a808506756d703b58a17b928f10e923c33997526bb5dc
MD5 1df37dcfda5b21a58742844dbcac6a21
SHA1 614099a6057bb89fddd4ceaff67ccad375c0cb3c
SHA512 9e5950b5c9b03669ca9dde61c7349890d62ba7e5e4142f1afdcc092b8883371ccb94815007019ce2bcdd7ef43ecf147d3de93ad9cacf1a9254f67dbc807acb7a
SSDEEP 24576:BCWk+tIYI0LxrE63BDcYrVQpV9Wjv9pQ8lQyRH:Bjv7LS6pcYrVEV9Wz9pQ+QyR
TLSH
T18CF52AF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E995B8CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.3MB
SHA256 635d430ec3d65ece5b18b531a9267ade906d2335a2e108be4d7598603f5da6aa
MD5 e3a4536ad558727f120a39e2db154329
SHA1 0c7feee7608e248468a541b18de672f4982f30f3
SHA512 f72cb0192462d2d1958b4dba96b84c3b816493e7aa106eb17f0d0986afaf6a03e320f53292059e47a65c71c12f664e5fc0585ec8f7874db9eeef8815ed74502c
SSDEEP 24576:gCW++tIdfnUxrm63BDcYrVQpx9qwv9AS8lQymH:gjUvUE6pcYrVEx9qg9AS+Qym
TLSH
T12CF53BF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E895B9CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerInstaller.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier
Size 171B
SHA256 243bb2214f020320abec2d97c888970cc4a46a466324cb5ef9278ebb8ced18c3
MD5 4bde3cb020bf9b481bbf0ad1ce74c66b
SHA1 93315676eabfd9cb4bf50cc7d5c1d31982b1feb6
SHA512 3c2cef81ab917b9bdd5a28a711b1656a23fecad5cc4a3aac54abaf6f986cd479bc66c80e3e7c3c3b43d3d5027ddc021e23c31648f498057a30e0479e0710c91e
TLSH
T1D6C080E28A058550351423CD33EED4AD77475615454D83D0F441A4D7554449F7660646
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerInstaller.nf89E0Os.exe.part

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.nf89E0Os.exe.part
Size 9.4MB
SHA256 b112a9fec58816f9ee176a31c0f52e3cf94b4dfec07975ed67ba9eb911fd951a
MD5 133aff3d0848579570639fe9564be495
SHA1 cdd7705ce581282e78079c55148ef4178f6cc25d
SHA512 660c2d31c79c2a9f4c49fc2482be8bc1fa2a4bd4fafce1b7f248c962759ac2e5c98f9ad48f0cb0c1a92a87453291fb776428405c89a39a8c253a78675ffff7f1
SSDEEP 196608:sfYe3Rcu2TzqUrREheMAF80c31NfEHsB1C5TJP:sOu2vl4I8H1NfEwCVJP
TLSH
T1AAA6BE22F940C031E5C102B2E6BDAFB65E7C9E240B7954C767C459BC59305E33A3AB6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI8CBB.tmp

Path C:\Windows\Installer\MSI8CBB.tmp
Size 149KB
SHA256 386a4209241d3424783e2456ef79988a1032a9f4ead891b5551253520e439ee0
MD5 8eabeadadc6d03c9807787af28381b65
SHA1 b5015709fb98a8a849a0440c54c07c394e89bc59
SHA512 18ddec2d28640108faf5a4b9878cc0e6224fdc6ee26bd9fcfc2c972d0ea82a21468181c6fcc3413a99e2a9bc070e71d41c998528a324eee93ee1b59351b6f037
SSDEEP 3072:CJdLyE16iOLin7Q4RZUKnnH1uhC7vu/2nrZ/yqMPu:CJdLT1jXZ/H1dRxt
TLSH
T171E3AE01B1D08072DABF193A5434DA725F3FB9209F508ADB53988A7D9E702C09E76B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI8DB7.tmp

Path C:\Windows\Installer\MSI8DB7.tmp
Size 542KB
SHA256 043004a5c963bb150211bbd812ef84275c5095d65951786f7674c032f38bdffe
MD5 8b09c6262c389bb90accaa3c252855e9
SHA1 ed170328be0c4b8fc51f938f9493fcdebdcf54b4
SHA512 561f04fd0b61b587bf4007c3abe9c5424013b6b906a971f038d9b1221d89b0f1ed6bcd4ad726f2a90043135b8f5a1649a9ee1ff7b4295bf2c0704beeeb5bb042
SSDEEP 12288:+PVdJDcpje+7oBeBddgp+zTiAaDAFdVMs2fep+i:+dPydgkzT4ARwfeYi
TLSH
T1ACC4E02633F80DBAFCB79235C9234A05D6737C611930DB5F03A4025ADF6B794A939B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Common.dll

Path C:\Windows\Installer\MSI8DB7.tmp-0\Common.dll
Size 15KB
SHA256 3f7ca0eeb1dd21da3c7e3520de81cd69f14606c4769084e346b004e8485eb770
MD5 0f907d122efd1e93d9a60303064ee546
SHA1 5c412f7efaeb992b20ecaca3f067170de0474986
SHA512 e33236476d0e045167c578b0e7ca137bec99c3db4a92e212fec5fc64f232cd84b24a72a0478b474c7d3cbf30bea2c4f6227b752f93d34095bf73e85da6f5a956
SSDEEP 192:86/odT6QmgaBE0z3tpqXRwrTm1m9pcqP6fU0W99a1jzaHg8XsEFtT1gOBNf4rqby:b7ga77iKm1lqP6Y99a1/aHsEf1P62y
TLSH
T15362F60563FC416EEABF5FBCADB113A24579F7527E02DE6F0A94804E0C3375A8460A67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Warp.Installer.Actions.dll

Path C:\Windows\Installer\MSI8DB7.tmp-0\Warp.Installer.Actions.dll
Size 22KB
SHA256 48097b83109cd2ad999a8945b246699fde23a97d38cff85a84a25024da388bff
MD5 77b520f199be8c2b9c42b9d79e647cdd
SHA1 a43cfc7f8e2164a62b67a433037bc2781c03f048
SHA512 231e21c4f6c8011533a2e72aabd18494780dbea2bf23ee0312352ebef571674cc854ddf84fdf18c9d6a381c6727338a6e6331bf4485f6fc24234dd8c5b091b7b
SSDEEP 384:dfg3Lz+w3k8o+R06fUMrTftezgJEFlxw4P3bkzRsPo5djidYGUOfmsbv3XF:5gbzjkUf0Xbky0i6FsmUF
TLSH
T1D5A2A641B3F80625FAFF5F70BEBA111049BABC99A932C75D099440CE1877B8695A1F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\MSI9903.tmp-0\CustomAction.config
Size 1KB
SHA256 5d6fd5049f33ac6b16ec0431787fa61c66630ba1916bb4c70f3f6b5844b74ecb
MD5 8c22d283225f3bdb8e36522c359796f9
SHA1 cec5168b62bc7d39930e0843a0a285c3d89ed23e
SHA512 826550987a6140b870894c02c20f1c890e187c5919fc60f5fe3fe962fc87bfcc3879ee1de6141d679aa85f6cf52f8be88a9b23a8d43b8561b6b70baf138ada3e
TLSH
T19731018E4A44A77721312767ABED91C1DB79A1AB3C91811834DE99242F16968137338A
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSI9903.tmp-0\Microsoft.Deployment.WindowsInstaller.dll
Size 183KB
SHA256 791da16b0df6956e88b04dab8b543b99dc2abd9af24aa25208fe5a0981e811b3
MD5 c2c83128276cc7c9cccc399bb5d76031
SHA1 776f9ca8175d95d0bc7c44847d60091bdf415041
SHA512 c8651107f699daa299182dbe594da76cd794ba0d7661a483aaa932f0967a3af5761c8e8a3250cb501019d39b483d09427ac75aa7fa3a191a090e226d8d9fd515
SSDEEP 3072:pGfZS7hUuK3PcbFeRRLxyR69UgoCaf8xzCnfKlRUjW01KyPePc:lzMRLkR6joxfKK3
TLSH
T1CC047D2953FC473ACAEF4778E2614261D7B1F2E67117DB0E9C8181BA2522780F792397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9F9C.tmp

Path C:\Windows\Installer\MSI9F9C.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 9ca742c2d29fdcf23d5133c055879dabd45d946d9b0d7437425745cd3ec6d3b3
MD5 60c4e5c40b7ab060b95ccc453ab176fd
SHA1 99a877d7a2c1452f191449b30f879935f124d7cf
SHA512 c407f0658806fccaf3cd4fd5c9a2f74ed14e589b2f2334f1139f9dc197327071ffb1ff48ab47d5764aa039f51ab58dd0807eb2c4a6497e972ee40671c7768d16
SSDEEP 24576:B2gmSp1SdoO/vvTLvmEuB0Hq/6pPwYgOWWXd3JEUN/6IkIQRoPFjr5eDB:6
TLSH
T1CB47D12436F92210E7B39E3C6CF06A234D3A7D5B9C15DE8D05461B8E0961FB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{d06c490c-ef74-4d21-a7a3-96847ae651c5}_OnDiskSnapshotProp

Path \??\Volume{f5ca1e61-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d06c490c-ef74-4d21-a7a3-96847ae651c5}_OnDiskSnapshotProp
Size 6KB
SHA256 fe9a39dfa8502f2c9b5cd85127806b9969f0d86c3ff7f650609edbba033d0c45
MD5 3e0d93d0c5647cae5043117c47a6026f
SHA1 13695cfa9b4762c15def50457ee2fcddd11c9042
SHA512 1aff5c7c71970a05e3c39e4a75e0f9c18e59cdf9cb39f3bacf53af3344132a209d7fbd06ace62fe7863a82506405d9975087db649e6ebdbf39d400142c5a5ac1
SSDEEP 96:Fdfjvvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:P5b++ZVm
TLSH
T1FBD179085AE54711E2F3AB3129F14557A877B911EF33CB8E0298638E6670A14F835F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/868-250-0x0000026E37570000-0x0000026E37578000-memory.dmp

Download

memory/1352-1361-0x0000000001580000-0x000000000165F000-memory.dmp

Download

memory/1352-1045-0x0000000001580000-0x000000000165F000-memory.dmp

Download

memory/1680-1322-0x0000021275B40000-0x0000021275B4C000-memory.dmp

Download

memory/1680-1321-0x0000021275AF0000-0x0000021275AF8000-memory.dmp

Download

memory/2088-243-0x00000000007A0000-0x000000000087F000-memory.dmp

Download

memory/2240-242-0x0000000001090000-0x000000000116F000-memory.dmp

Download

memory/3708-156-0x0000016F41660000-0x0000016F41888000-memory.dmp

Download

memory/3708-144-0x0000016F206F0000-0x0000016F20737000-memory.dmp

Download

memory/3708-171-0x0000016F1EF30000-0x0000016F1EF37000-memory.dmp

Download

memory/3708-174-0x0000016F20740000-0x0000016F20780000-memory.dmp

Download

memory/3708-178-0x0000016F40F60000-0x0000016F40F85000-memory.dmp

Download

memory/3708-181-0x0000016F40F90000-0x0000016F40FA7000-memory.dmp

Download

memory/3708-165-0x0000016F40EE0000-0x0000016F40F0A000-memory.dmp

Download

memory/3708-141-0x0000016F40E50000-0x0000016F40ED2000-memory.dmp

Download

memory/3708-162-0x0000016F410C0000-0x0000016F4121E000-memory.dmp

Download

memory/3708-168-0x0000016F1EEE0000-0x0000016F1EEF3000-memory.dmp

Download

memory/3708-147-0x0000016F1EF00000-0x0000016F1EF12000-memory.dmp

Download

memory/3708-138-0x0000016F41260000-0x0000016F41654000-memory.dmp

Download

memory/3708-135-0x0000000180000000-0x0000000180A25000-memory.dmp

Download

memory/3708-150-0x0000016F42600000-0x0000016F43588000-memory.dmp

Download

memory/3708-187-0x0000016F40F20000-0x0000016F40F29000-memory.dmp

Download

memory/3708-184-0x0000016F1EF20000-0x0000016F1EF2D000-memory.dmp

Download

memory/4724-2-0x0000023096210000-0x000002309621C000-memory.dmp

Download

memory/4724-249-0x0000023096210000-0x000002309621C000-memory.dmp

Download

memory/5060-247-0x000002769B1E0000-0x000002769B1EC000-memory.dmp

Download

memory/5932-50-0x0000024031810000-0x000002403183E000-memory.dmp

Download

memory/5932-54-0x0000024031800000-0x000002403180A000-memory.dmp

Download

memory/5932-58-0x0000024031850000-0x0000024031858000-memory.dmp

Download

memory/5932-59-0x0000024031880000-0x000002403189A000-memory.dmp

Download

memory/5932-64-0x00000240317B0000-0x00000240317BC000-memory.dmp

Download

memory/6096-99-0x0000024DB90F0000-0x0000024DB90FC000-memory.dmp

Download