a616fa224c8c0b3da8dffa75fbfd85d36232d5e8e1da2898f5cf5ac95967b735

Analysis

user interaction
yes
max time kernel
191s
max time network
193s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 20:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LX63/LX63.exe
Size 12.9MB
Sample260423-zqq1eahx21
SHA256 a616fa224c8c0b3da8dffa75fbfd85d36232d5e8e1da2898f5cf5ac95967b735
MD5 3291a3b938e4a2b26d31761a15079445
SHA1 d1d2df8c7521d36b5b0f980ff4504d25630e6eb0
SHA512 65677fbf2041349e8e6fdbc4c0802776113598d01f8a9669d79e3f3dec361d4efb207ad6c233381b9fd107bfa8ac7e23ebb930d6cc27e820259752569d5ebca6
SSDEEP 98304:AEju52NY872mdU6sV2Jn0kuvtYng/ixjdJ5rnWTjqG6yrwBfpXKKq1Xgdub7klk:AyY89dU6SE0JB+lr216jBRXV5k
TLSH
T1C8D618207B5F99ADD15BC474828B4A62593130CB0B36B9FF449492392F6EBF42F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
139	2332	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
3360	RobloxPlayerInstaller.exe
1216	RobloxPlayerBeta.exe
5776	RobloxPlayerBeta.exe

Loads dropped DLL 2 IoCs

pid	Process
1216	RobloxPlayerBeta.exe
5776	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LX63.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com
8	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
1216	RobloxPlayerBeta.exe
1216	RobloxPlayerBeta.exe
1216	RobloxPlayerBeta.exe
5776	RobloxPlayerBeta.exe
5776	RobloxPlayerBeta.exe
5776	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\configs\ReflectionLoggerConfig\EphemeralCounterWhitelist.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\SelectionBox.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Controls\spacebar.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\sounds\impact_explosion_03.mp3	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\AnchorCursor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\clb_robux_20.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Controls\TouchTapIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\PivotEditor\PivotEditor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\btn_newWhite.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Chat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Settings\Help\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_23.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\MenuBar\icon_leaderboard.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Controls\PlayStationController\ButtonL2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Controls\XboxController\Thumbstick1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Keyboard\key_selection_9slice.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\ImageSet\AE\img_set_3x_1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\AvatarEditorImages\Sliders\gr-slide-bar-empty.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Controls\PlayStationController\PS5\ButtonTouchpad.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Emotes\Small\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\sky\noise.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\AvatarEditorImages\Sliders\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\AvatarImporter\img_window_BG.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\DevConsole\Filter-stroke.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\fonts\RomanAntique.otf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\VoiceChat\Misc\MuteAll.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\LuaApp\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\AvatarEditorImages\LightPixel.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Emotes\Large\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\ScreenshotHud\Camera.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\VoiceChat\MicDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\LuaApp\icons\GameDetails\contentRating\igrs13.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\particles\smoke_main.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Controls\dpadRight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\TopBar\HealthBarBase.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\particles\sparkles_main.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\blackBkg_square.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\fonts\AmaticSC-Bold.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\avatar\meshes\leftarm.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\advancedMove_joint.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\StudioSharedUI\search-v2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\Controls\PlayStationController\Thumbstick2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\content\textures\ui\VoiceChat\SpeakerNew\Unmuted80.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\Controls\DesignSystem\ButtonA.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\LuaApp\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\ExtraContent\textures\ui\LuaApp\graphic\Auth\classind_12.png	RobloxPlayerInstaller.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_2085006779\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_380949918\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_380949918\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-eu.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_199421345\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_380949918\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_199421345\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_1805678211\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_1805678211\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_2085006779\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-und-ethi.hyb	msedgewebview2.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2332	chrome.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134214513639271819"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 31 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-2e6461290a3541f5\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-2e6461290a3541f5"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-2e6461290a3541f5\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-2e6461290a3541f5"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-0c771458892e42b7"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-2e6461290a3541f5\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-2e6461290a3541f5\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3332	chrome.exe
3332	chrome.exe
4884	msedgewebview2.exe
4884	msedgewebview2.exe
3360	RobloxPlayerInstaller.exe
3360	RobloxPlayerInstaller.exe
1216	RobloxPlayerBeta.exe
5776	RobloxPlayerBeta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4768	msedgewebview2.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
5048	LX63.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 4768	5048	LX63.exe	78
PID 4768 wrote to memory of 1500	4768	msedgewebview2.exe	79
PID 4768 wrote to memory of 2700	4768	msedgewebview2.exe	80
PID 4768 wrote to memory of 2700	4768	msedgewebview2.exe	80
PID 4768 wrote to memory of 2700	4768	msedgewebview2.exe	80
PID 4768 wrote to memory of 3576	4768	msedgewebview2.exe	81
PID 4768 wrote to memory of 3508	4768	msedgewebview2.exe	82
PID 4768 wrote to memory of 3508	4768	msedgewebview2.exe	82
PID 4768 wrote to memory of 2160	4768	msedgewebview2.exe	83
PID 4768 wrote to memory of 2160	4768	msedgewebview2.exe	83
PID 4768 wrote to memory of 2160	4768	msedgewebview2.exe	83
PID 3332 wrote to memory of 1000	3332	chrome.exe	87
PID 3332 wrote to memory of 4716	3332	chrome.exe	88
PID 3332 wrote to memory of 4716	3332	chrome.exe	88
PID 3332 wrote to memory of 2332	3332	chrome.exe	89
PID 3332 wrote to memory of 388	3332	chrome.exe	90
PID 3332 wrote to memory of 388	3332	chrome.exe	90
PID 3332 wrote to memory of 1112	3332	chrome.exe	91
PID 3332 wrote to memory of 1112	3332	chrome.exe	91
PID 3332 wrote to memory of 576	3332	chrome.exe	92
PID 3332 wrote to memory of 576	3332	chrome.exe	92
PID 3332 wrote to memory of 2528	3332	chrome.exe	93
PID 3332 wrote to memory of 2528	3332	chrome.exe	93
PID 3332 wrote to memory of 3024	3332	chrome.exe	96
PID 3332 wrote to memory of 3024	3332	chrome.exe	96
PID 3332 wrote to memory of 2368	3332	chrome.exe	97
PID 3332 wrote to memory of 2368	3332	chrome.exe	97
PID 3332 wrote to memory of 548	3332	chrome.exe	98
PID 3332 wrote to memory of 548	3332	chrome.exe	98
PID 3332 wrote to memory of 4776	3332	chrome.exe	99
PID 3332 wrote to memory of 3896	3332	chrome.exe	101
PID 3332 wrote to memory of 3896	3332	chrome.exe	101
PID 4768 wrote to memory of 548	4768	msedgewebview2.exe	102
PID 4768 wrote to memory of 548	4768	msedgewebview2.exe	102
PID 3332 wrote to memory of 2100	3332	chrome.exe	103
PID 3332 wrote to memory of 2100	3332	chrome.exe	103
PID 4768 wrote to memory of 5464	4768	msedgewebview2.exe	104
PID 4768 wrote to memory of 5464	4768	msedgewebview2.exe	104
PID 3332 wrote to memory of 5604	3332	chrome.exe	105
PID 3332 wrote to memory of 5604	3332	chrome.exe	105
PID 3332 wrote to memory of 5804	3332	chrome.exe	106
PID 3332 wrote to memory of 5804	3332	chrome.exe	106
PID 3332 wrote to memory of 5580	3332	chrome.exe	107
PID 3332 wrote to memory of 5584	3332	chrome.exe	108
PID 3332 wrote to memory of 5596	3332	chrome.exe	109
PID 3332 wrote to memory of 5992	3332	chrome.exe	110
PID 4768 wrote to memory of 5588	4768	msedgewebview2.exe	113
PID 4768 wrote to memory of 5588	4768	msedgewebview2.exe	113
PID 4768 wrote to memory of 4884	4768	msedgewebview2.exe	115
PID 3360 wrote to memory of 1216	3360	RobloxPlayerInstaller.exe	117
PID 4768 wrote to memory of 5396	4768	msedgewebview2.exe	122
PID 4768 wrote to memory of 5396	4768	msedgewebview2.exe	122
PID 4768 wrote to memory of 3872	4768	msedgewebview2.exe	127
PID 4768 wrote to memory of 3872	4768	msedgewebview2.exe	127

C:\Users\Admin\AppData\Local\Temp\LX63\LX63.exe
"C:\Users\Admin\AppData\Local\Temp\LX63\LX63.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=LX63.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5048.788.6134696411366970318
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x100,0x7ffcafe4b078,0x7ffcafe4b084,0x7ffcafe4b090
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView" --webview-exe-name=LX63.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1688,i,10391928996249446370,6468066354656664248,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1680 /prefetch:2
    3⤵
    PID:2700
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView" --webview-exe-name=LX63.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1868,i,10391928996249446370,6468066354656664248,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:11
    3⤵
    PID:3576
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView" --webview-exe-name=LX63.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1684,i,10391928996249446370,6468066354656664248,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:13
    3⤵
    PID:3508
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView" --webview-exe-name=LX63.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3516,i,10391928996249446370,6468066354656664248,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:2160
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView" --webview-exe-name=LX63.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1840,i,10391928996249446370,6468066354656664248,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:14
    3⤵
    PID:548
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView" --webview-exe-name=LX63.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4372,i,10391928996249446370,6468066354656664248,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:14
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView" --webview-exe-name=LX63.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4268,i,10391928996249446370,6468066354656664248,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14
    3⤵
    PID:5588
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView" --webview-exe-name=LX63.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4712,i,10391928996249446370,6468066354656664248,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4884
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView" --webview-exe-name=LX63.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2132,i,10391928996249446370,6468066354656664248,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView" --webview-exe-name=LX63.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4688,i,10391928996249446370,6468066354656664248,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14
    3⤵
    PID:3872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcad89c728,0x7ffcad89c734,0x7ffcad89c740
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,2657001683475591604,10116376220381661156,262144 --field-trial-handle=1936,i,11485874601336465420,7222330050760126620,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,14744824526165647638,5485795785356950802,524288 --field-trial-handle=1936,i,11485874601336465420,7222330050760126620,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1832 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,10226528053663904452,18234623407816767104,524288 --field-trial-handle=1936,i,11485874601336465420,7222330050760126620,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2380 /prefetch:13
  2⤵
  PID:388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,10800497645367147219,14785919220004588855,2097152 --field-trial-handle=1936,i,11485874601336465420,7222330050760126620,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,7202714502642259653,15558060888719057170,2097152 --field-trial-handle=1936,i,11485874601336465420,7222330050760126620,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4196,i,11280375859639812956,1499946041597106073,2097152 --field-trial-handle=1936,i,11485874601336465420,7222330050760126620,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4208 /prefetch:9
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4492,i,11519203587733378447,1070277074308960583,2097152 --field-trial-handle=1936,i,11485874601336465420,7222330050760126620,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4180,i,4090829971399316272,2540696648166531324,524288 --field-trial-handle=1936,i,11485874601336465420,7222330050760126620,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4164 /prefetch:14
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4960,i,10999228307326914459,9787651598919999536,524288 --field-trial-handle=1936,i,11485874601336465420,7222330050760126620,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4972 /prefetch:14
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,4623733142269664120,1882348233050253421,524288 --field-trial-handle=1936,i,11485874601336465420,7222330050760126620,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5716,i,11769905987742730331,12818572550473598595,2097152 --field-trial-handle=1936,i,11485874601336465420,7222330050760126620,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3600,i,6532306446315880709,596868054392498599,2097152 --field-trial-handle=1936,i,11485874601336465420,7222330050760126620,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5768,i,244455091869112834,9468014420362133752,2097152 --field-trial-handle=1936,i,11485874601336465420,7222330050760126620,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6080,i,1016647090678924918,6931390924270403724,2097152 --field-trial-handle=1936,i,11485874601336465420,7222330050760126620,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,11875720878956452622,12337059179839093290,524288 --field-trial-handle=1936,i,11485874601336465420,7222330050760126620,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5716 /prefetch:14
  2⤵
  PID:5580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,2139108113297065819,13414421236051335516,524288 --field-trial-handle=1936,i,11485874601336465420,7222330050760126620,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5636 /prefetch:14
  2⤵
  PID:5584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,15900813649550258568,11460222806649133799,524288 --field-trial-handle=1936,i,11485874601336465420,7222330050760126620,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:5596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4284,i,17547981771029053913,6708505082692011381,524288 --field-trial-handle=1936,i,11485874601336465420,7222330050760126620,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4212 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4076

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5492

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 3360
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1216

C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.4MB
SHA256 08fa8ed4fbdd8434832d198ef981ec953a719dd7abb2d6ea0c2985d57c542089
MD5 2b68d224d3ae3760a24cb64b66c2de3e
SHA1 00fac07a9904e10e7ee39e025bbc89b2aa8259b3
SHA512 4ab3153e59baec2e088fe14ee902f14de69f26f6f9dc9036d0add7d1070236bce441f0553bd5961ebad0416f6beb33976a5a484589a4f9f0675dae900e131a8a
SSDEEP 196608:k/obnhP/XRX2H2B1RAjCq4IvzExFL+TABhDMQT0:kuVBXvAeJmzExFL+iwQg
TLSH
T137A6BE22B940C021E9D202B2A6FDAFB65D7C9A341B7944C767C45DBD45305E33B3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files (x86)\Roblox\Versions\version-2e6461290a3541f5\RobloxPlayerBeta.dll
Size 15.4MB
SHA256 f937e00724f5ed12a0b662e2b4b07ec1f61a6204a34fe047f3b57530a730d9fe
MD5 580a2caefc86d689058d908dd6b07a36
SHA1 8b36c73d63e7fbf9fe8122c5a293597fbc3dc270
SHA512 b5a0fc7bb6436e4a57b3f0e97a469a1fa023738a13a6954541c2ea872a1c47b13a7b3abc2546d447b56699a53874b724577f4f15bf2d0098833337cfda6255c8
SSDEEP 98304:+M/piZg8dlnAC+YnbQMSTETspSgI4qB+xRmc/hyR9fDx/MEJ2mKzZec8DSbpR4SH:+M/pQlEyv/MEJ2jenD+R4S7OuK
TLSH
T133F6D04FB5E24C28E1729079903F33D7DA16718C4A186AF343D952503A7278D6A2DFAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 44c15a686c7859b7ade54146f5317f7d80f861bebd81c118c0de8b975387a964
MD5 9b5c816c44e539139f88589177a6cb18
SHA1 5a9f8547cc7b3f059c98b8c68730195f06d3f306
SHA512 0211c45c72677e522fe56a3f827298998e434573aeb99ca20bfb683d48c5e42ad64ceba07d9ed954e14c31bc126b3b69731d205f7da7d9bf86e424421f2c04b7
TLSH
T1CAE02BDED921DC2708FD076860540B46F720136B6741898F3B7C810C4FB066B0A8985C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 9f98abfc5a5e35ba618f24a08cd0b243fbe191fbc59ece1aaf214ef1242a98e9
MD5 5c6c24a073749792b5f7912d277812cf
SHA1 ca4828a5d0d04f094ec88c924b85293185b97364
SHA512 6b5afe44d066765e11ccd448952d7264551e680cb35a115d174d8dcdb9ba8862fd6aea49f78ea7dee888b4edfdb640c23541f15ee91f51e0cdedb03a20e6150a
SSDEEP 96:KHmhBdx1WjO3TYtt83/WjdryXYjZsk9/jkB2eTHnZBXiZovMNfmIbGToTQsaGoZf:+mPX1WjOjYtt83/AdWXYik9/jkB2eTHR
TLSH
T1F0813ED583C0FF1ACF618732CEA6FC596E3922E06E03071B02D6582A350F2FC119525C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 15f64f547031ae648efb61c2451a372703265609f57258c9863efd8d924632ef
MD5 d65ec75f9c8d8afd5a8e33dffceed644
SHA1 2d08fe0280db1e6d2f99d15bb73d5074503f6046
SHA512 f295c1c8d461d6a8e08c5aceffebe03beeac0bbc817b11ff88e98afeb717d6694ce9d55c9802526c3017db0a19d370f13af493c26c12ebdb911e551ac2817f29
TLSH
T15851DDB3C3E8997D881156F4AA246F2BDD7A0A14531C3C56C8D8AE0F57F28B6E21124F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 b9a65296ead85bf35d6650863037587be2c44bc4f0260248f16c89790f6c6c28
MD5 86c3ea765ad69de83451041a030ccf46
SHA1 fa87dde6ad2fa20154f93ccb2e8763c62e17e4c8
SHA512 d219205b0915eabab35a54c6a2765eb646a7cab39cc805f0b4130b8ff971f57813ddcbff5b8c957266c5af2c249eae074500280593dde520396be9858381a414
SSDEEP 192:DNb2ZTYwqqveteQIaa2nMcd3UoTMWJSIouxQ0Drk1PodNMHhGuHjnY2Ha:DNb2ZTYwqqveteQIaa2nMcd3UoTMWJSs
TLSH
T1841278B7C3E8C62D891156F4AB156E1FCE1D0A24031C3D67C9E8AF4B93E2972E21165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 01a2e1003a9079f31ce1abb447cdedffde5b2e6302345df62715c714e6deb022
MD5 72726c80ff76073372a44764e075fa1d
SHA1 8a9eed8770e8f77d04fdb33d75e69fda0f99f752
SHA512 f752d55111c981f8c1b32d79800df9bc26163e6bb513a7d9561a70da3971c4f583056d7b40e29861f592ef6970c5bcd6fe1b9790912c4809f5058d454e5b60e8
TLSH
T1AA5189A78F7AB45B643D0A7F6E40BC0915ADB83901D16CF4CFA6C0ADB0898F70B15462
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 cfb6b64298e697bd6a3c0dc26e2e16d21d1fceca31a1d2463268e89697233a77
MD5 bae1a62e675921c3a77b16664b3386bd
SHA1 bd9340d17d88c9e9445d299dc7612698c710d595
SHA512 fa7248c47f107a472f9627086b63bf6498bd7a5c19036a4ef201e4d06624d676257220afe0f45ff1535b8ee588abc96f756bc0b289630065c308c341790f2a4f
SSDEEP 192:QRucBznoSFbiOQv7ApAPRp21Qb9qHsb+WNndU94WY2oj3cs2qbykwDVyIsnAUgtK:QRumznvLMsUXt4w29W2G3cs2qbyF8
TLSH
T1CA52F82EB914693B5CCBD229F961B757E3F5003271942E84EAFC8A2C11E79CD761B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f1290b3cab13d3986f9af745caad781a0c609be4dde5ef363348af93a9344418
MD5 32114a3386dc575fbec020d3a05addcd
SHA1 5e97e61aca491244110a059a8b06f35f649229dc
SHA512 409723cbb0408659a17339e30766679773bb79366defaa5287f658b5d0e4d79614415a187ab2a138b01725a7dcf09c65752aec212154b8540e83a8c05e18a941
SSDEEP 192:QRucBhXoSFbiO1v7ApAPRp217FB9qHsb+WNmHU/LdU94WY2Nj3cs2qbykwtVyIsB:QRumhXvLFsUX84w+Qi9W2h3cs2qbybe
TLSH
T1CF52E72FB914697B5CC6D229F911B757E3F51032A1942E84EAFCCA2C11E7ACD721702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0daccaebb91adfa072c014d48ae6519568207246a570cff75549cd37abf24c36
MD5 5c82d4b44911e4b62c0d184997a5af3b
SHA1 90375b0ab5b5bbf46bd63d30bf7afce83597db6f
SHA512 024f1eaf82657f81c151469f2829bd41fda0d073aba0af070590648bddb57c90122a984f7ff787fee24c02203e56bd917b0b2e25bab4a7f429d574390961b8e4
SSDEEP 192:QRucBznoSFbiOav7ApAPRp21QmV9qHsb+WNoFX/LdU94WY2oj3cs2qbykwDVyIsH:QRumznvL2sUXU4w2vi9W2G3cs2qbyF8
TLSH
T10E52D72FA914697B5CC7D229F921B757E3F5103271941E84EAFC8A2C11D7ACD711701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 02fa3748cc960b0ed806669146286ae61d8f8c37c72e1c20fff625c9b568d7c5
MD5 e1d791f76039330e35fa0e1827d639ea
SHA1 a37e7b6749565fdef84e626eb8e8ab5cfd1eaf09
SHA512 4cd2d4ec371de591ed8fc49a3c9c69bf2d80c0d8879044f55af268ee4a35e216538e529304db502c0dc2822c3e20cfadd9949c623d30489800bbc0cdffa3ddcc
SSDEEP 384:2Mjqt7KxkXqKf/pUZNCgVLH2Hfgslo67pLuLcifklXODqt+ErU3sjHG9TDWxSal2:2Aqt7KxkXqKf/pUZNCgVLH2Hfgsq67pU
TLSH
T1B672E8676C0C9D7B0F94C58CD8267E4FADB9024B65ED886483FA582A03D5BDF110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 cab5a1b76f3c1d343d6758fcc50500faa875563e21460dcd35e3da58a5a8ea89
MD5 55287d628e6a370ec4eaf83ce444d5c7
SHA1 9222f294945b4884487ed49ed8739ef08c70c890
SHA512 8cc07c75c1a541e7e6ce85b7fcd9b5aa09d70ff6d82e74bcd6b5ad19e23b06ead2175d49673da0e80d6905f6c6e72acb4d95967330e393325f651c233284517c
TLSH
T147B0125080429501C00703FC1186648832189F118B0E230A53F069B59C3A2D04019160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5959de.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5959de.TMP
Size 96B
SHA256 af5f4f7330c5846147d67bd8dadc24c469fca293bfe5ce5bfd9258a36ddaff48
MD5 a8ea30f986a889ed2bb03a4dbcffc844
SHA1 3c0a5db9bb130df6a87299476b099aacdad8f645
SHA512 c5ba095896f65fdb9303235db4ba92f2b6e497cb2c7f45481816283b5bcd1ea76e359d0338f19f21c26e836970f555ab05e50e2fef00c846a98cacf10577540b
TLSH
T17AB02202C002F222C00223B028A080C83020CF22C203020B82E00A22CC2C2200028820
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 150B
SHA256 7abf543cf6989a509e1261ec60a119fbc60a7a138f87936aeefea71516b434b3
MD5 a77ca30785ded2642c926e0cbcd57f39
SHA1 ab820c0c541a1c216971390e8ba90329dbdf7307
SHA512 42aad328961c5dd2902430789bbaf9132515ea772bcb9458a45bc03c6e927637ed8b75f844c27023e0d9269cfa02ddd16623b3ac31edb877b87c4201563b945c
TLSH
T1A5C04CD72859C54F4A30E9DA152C762ED96BA64C4CC8CCEC9505518630789334952969
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59ac53.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe59ac53.TMP
Size 157B
SHA256 8270b4f8dfdf3172dca5dab276a36e6a7cf0663560f4e68748baffa996026c6a
MD5 ada9a1c2d7c5a6d0de89eea57e277530
SHA1 1d250e94196a0b473d95fa95f548da79f8f500f9
SHA512 468b6302a8637ba458ad26f7a551fec1360d5a737d63eeb7fd27d0128e3421417f9febcf4fac9b76427e2571736c78817f8ea6e12be3cfa7c38c1f17c7e702f0
TLSH
T143C08CD32869804F0B30A4CB202C361EC82BAD0C4CC8CCEC900A308630389338C41929
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 2372c9651e3f9144d3a6a0ce7dd201fe904e77b40e44fe5a9113ed840a8ab583
MD5 1d8ebb29f6f7611babf43c414ee7572d
SHA1 184f32af62d49c03956429b4d3a90645f6cf8ad1
SHA512 c1afe638f173c237c7a6361d86b6b4bed02b1a33c086c46b2c021335cb7bbdcfde9a52cd95a408ce9586231f136d211d7c74e31b65abbf9b048e43bc0fc4dcf0
SSDEEP 1536:hZXP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:H++J3qUQm08KMWF0bFTcVHr6zT
TLSH
T1939312BA591E7D39636AC396D0079CAC8CE3CCDE1514557C30C7AB1E18BA393A30B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 e9e5e881fe61269237d933f3af7812f37428bfef89feb42fad55f49d3627b76a
MD5 ac9be98fd8c82780a96b55d2565d99a7
SHA1 eaf0da26be963bdd81b5f3ba62f0de171f1d05b8
SHA512 617e5c898a216aeb826b56cba38f7e6b1f37125449a61aa7468f2c12177495b92d1c5ff0839e707da93d50a28f992fcd47c4d2fa1e6c55ad177ea1abd737a3d7
SSDEEP 3072:sMWKBE03iPkDZmne6ST02NBVByvD4u+++J3qUQm08KMWF0bFTcVHr6z1:9+yiPSmneffr++JjcMW2VcVLm
TLSH
T1581412D5AE1B6DBB0269C232A207FE484CD2D4AF5511416E22D1BF8E146F3D5530BDE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 2ed3af48f90abbec058a7e1a64a2019da95365883528ac997ba4d552f2458778
MD5 9c8a6c70f6dfc5989d78ef33045ead90
SHA1 20202336e2d4c6a3dac7397421e977099755d8f3
SHA512 ecec929360d85a597249189331328c0248f25aa889c60e37386c43b51c936e8559a22cd5648a3ac258312db7af0e15caac73f6469a305c27a6c6db8e93e21455
SSDEEP 3072:TMWKBE03iPkDZmne6ST02NBVByvD4u+++J3qUQm08KMWF0bFTcVHr6z1:I+yiPSmneffr++JjcMW2VcVLm
TLSH
T10E1412E5AE1B6DBB026AC232E207FE484CE2D4AF5511416E22D1BF8E146E3D5530FDE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e7caf4ced223e9b79840175e2b8d4540dca4d02bbf122c20fde1b50fbde9ca7f
MD5 fa9f24b4998d7e6035f1c69f6664fdbe
SHA1 2d13abf21fb6238dbf03796ea51585981b6a952d
SHA512 38daefdce0adde96dbdb8fe19d7460373e1a9d2867e0e77c04adde5ff4fc6d6527c839520718c5010089cec8e19db3e2ceb0d9777bad11e0a6de43447f383502
TLSH
T10FD0121632014534C02025B3004262080480C62F41458048642C95AF1B44478090B442
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 752bdf8e2c381312d947e435b6ddd7b9dd6d2d42d9da687e71140790743c1abb
MD5 baff0c9ecc24aa8d94d6e292dc2d74bc
SHA1 ecf2a42cd02e600836fb4aefb8a215404fae85b9
SHA512 4a36a6a540cb43ddaeb2a028d9edfb73f4255e668b4ded924e67317006175fffa50f937bae29ec33d3730adbbd173b2cb2a3fc4bf778848ecc0a13edf465b02b
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

91a83956-3c7a-469f-bbd4-7a9bd77d0e6a.tmp

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Default\91a83956-3c7a-469f-bbd4-7a9bd77d0e6a.tmp
Size 6KB
SHA256 bba05dd890554ab9c6c73512c9973a17f4566d3f19d8726641a64ae6f96f4d1d
MD5 71729e53ad5941d72a79e0a8fc924229
SHA1 8c175d7a13f000d57779ff5bbf2862fce464c1b3
SHA512 45d64bf6c5df74a012d7f1a1392be038ac3744c10ba72eb7de770cee68fec0ecd5425133cc29256004c00df98ed57917da323b061abbb08656f84f377338452d
SSDEEP 96:stN0518Hgb9x/Sff7Z8i0vhErktdm/7qx+WVHMSm+uecJEL1idQjF+gDV3e0MEB:stN0DtqfDZ8paGg/S+WiTELwdQ60M8
TLSH
T190D197079E24697B4CC7E2197A35BB12E2FA106662D41E98EFFC861C09D56DC620790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 72b6c261b539c9469714120614ab17b46f7e70b42178721bd8273fac93465904
MD5 85d929078c23c6ccdcf548ad24368618
SHA1 335c9900033bcb9ebf70a60d91ca2b83bed8e105
SHA512 0b9b0dbdc46681f3d57f112d79fbb6dda19b5092e504bc48e78decb85eb2bf3eea26b641fefcc3b2a71295c365dc30942e71376894c16cce9554d3991a593752
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 eff39ea384838fae332373b2ac02e1a31cf881f8c4ad1514c328262d34abbf16
MD5 0f080f7096dc1944bb7b5a53eefa87ad
SHA1 f8e16e9c0f537deb3e1247aca6fd657d92dd2f4d
SHA512 47230afb0d97b059f6e309b6eb6de5aa80640ba3968e7cbfa36db5d5b2397c2d63e97f82f33920dd5398f79a8f2c6b7bcb243b1f4ed3bf37cda22aa34d0975da
TLSH
T15DE0A7714BCCDA24CF730F75955EC8467063353F2205738B68CA2566A5265F1231E059
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 4a5da4fed374b44211373a6e69381d6fbc436a52efc45a70d9cf21ebfef1ba10
MD5 3d7afc0a4c1aa581e1bfc7480b258de0
SHA1 46c509865ff4ca33333bcadc658cff3106769d56
SHA512 f0e5ed6ef681c6587135c554cc69206df82f9a8bfd8343506bee82ba482cd77a9f704ad4ff40b46b8d4ab1260903b20c487d444989bca08c0086f9640e31a527
TLSH
T12921D0A283F0C66D8A1166E027343C1BCD2D041993287E37CDDBFBA66BD24B1E11164B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Default\Network\Network Persistent State
Size 816B
SHA256 91bf0802072f0b33d31ceeef6a8c7ccc9afcd889899c9321ee59fa981157e303
MD5 aaf0c6f189f35898de41352aeba20a8e
SHA1 3dca361e35755591b137ec4b80cee5a756e7a818
SHA512 64d30cc3c8fdb7b924cad2ad984e6a7c269aab25ad9eb11ee4bc1d03d36e23c13e54a85c4067930d2515f1c79112946c01f9521047b48895460072799fd63dce
TLSH
T1AD016FB683F0C67E8A5156E02B347817CD3D0419932C7D26CDDABBA55BD24B1E11054B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5930da.TMP

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Default\Network\Network Persistent State~RFe5930da.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Default\Network\TransportSecurity
Size 691B
SHA256 01a5603c1fe4aec7a9cf711f11d084dd73c8e50adb8f9bd54ef415c961218889
MD5 97b773b1bbd78db77fe6dbaca75d4fb0
SHA1 fdc5bead05ad6b1f4adf0eff42fe72850174f162
SHA512 4261ee853b51a3e388674e72beb4baccec4534b5b667e4c6a56363ebab55cfe255654e3a804ea91fd4798bb84bd7d1fb60d848f830fb7657c193ad58f9ff0f7e
TLSH
T13C017BA6D27EF42F203C05639E84BD44AA7AF475029270FCCF73806C68C51F79697456
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe58da7d.TMP

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Default\Network\TransportSecurity~RFe58da7d.TMP
Size 188B
SHA256 f1a9d244179300c6abf1a60411c54232386ba5d2a93baa3ff2cb22770edb19e1
MD5 e9b8395e70a915b442dbce3c729afa2d
SHA1 5e7c217b56fe9286c2be8dc8f6850eb4280270a9
SHA512 a7a8cbf04cc9920e1d9a9adae5ae4e26120ab9bd681cf124bbfa9d0b3fa0d4515f3df3502883f67e3a5ec4d7be0f8bb476e1582e922f30ec174b315c27525852
TLSH
T1C3C022A2802AE476A0380A219C80AE405E7BA130068058E986668B7C58C40BA6103002
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Default\Preferences
Size 6KB
SHA256 1684934df0c7203d2318eac668a96320db4a9320fb7201e51ec4be1b4e213301
MD5 65d35d8d42c6e6af7d5cf601c0d3f90c
SHA1 adcf09f4b8dc92c2ce0eaf6a4ab50b9fe19a1d8b
SHA512 9dee07243b0d062ff7001717ce59f4a0953c0aa9bd73b5ee1781bded929287d9e08673f16c6f3e9af75fbf8a560f0d86502d06ac4be65ac690de1fa40f4ade0e
SSDEEP 96:stN0518Hgb9R/Sff7Z8i0vhErktdm/7qx+WVHMSm+uecJIPMFHdQjF+gDVo0MAB:stN0DdqfDZ8paGg/S+WiTIPqdQA0MQ
TLSH
T123E19647AE28697B4CC7E6197A35BB12F2F5106262C40E98EBF8C71C05E66CC620790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Local State
Size 17KB
SHA256 6debf5ad7b462cb8ab8fc0cd6ffcba5203920afd251961959f53c8f360b19526
MD5 08bbbbb93eab5106faf16d55e7260c87
SHA1 73d98d6ff1b544e17df714e44739f3d0ce92fe75
SHA512 eeae1caf8c5334649f005721998e25f7a9abb6fa5955fdf66bed69dcbe81e7cfc734c4c83464b936a809c1560e87c9088bebe503480ad4200c2ab9bacc33efaf
SSDEEP 384:zXfRE5BdEZfr0kuh9Rt/nP9yQNgay0SX8VazNFmb3LQJ:7RkurqhNst38+mb3LQJ
TLSH
T1F4828E72D931D9336CE685463A4A7B02A6F4814EA5D52ED8ACDC2F0C0AC7BDE1353D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Local State
Size 1KB
SHA256 69444aa5b048c9256f672515486eda0b1dca3e85f14bc74f0b0ad442f5189c7a
MD5 3b641038765c2526378b195d76ebc336
SHA1 05023595a6c5e2017b5d89091e1646ba64978eee
SHA512 aaf6494aef500901ac07a52f850ab7df66a5794b7be2509f6eae1826cb09c54269d81beedbbbc4a8e09dbedd7b1638b70f717f9bee0c5f49bcbccc41ab24549d
TLSH
T1F5316273D4401BB2BC92954671A57B473E35106FC261AF8CA5DC9F0C02EB2CEA227D32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Local State
Size 2KB
SHA256 979e9c376f81184779c74355d72e918f2b3e4a6c49fcb195e560fef3333b3d6a
MD5 ea90db400dd5098e49b1781882d552da
SHA1 49fffcb0a49f7db5b15067622c44ed326ac1ccd9
SHA512 6d9bb1d895e61244e29df953f7514c62a7f63f8be1b1910b2874dbe14ba315e138a77f527e62e7a6f8386f76fcd49e92258a382be6d758e222baacf82f82519f
TLSH
T19751A773A8045A77A9E3C94579593F127E3A116EC6A13FA49ADC2F0C02DB29D2313C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Local State
Size 16KB
SHA256 a11489cbb1d4284fb59d57653c52b76fd4f40bb1190e39c2ef96f2b985a7dc12
MD5 75638741c006ac5443009bfa0675640d
SHA1 bbac81193ddc85ea1d222689c59f325c46fac4ba
SHA512 6faa2d0af21ee90c4724a959022e3e97c16b18f59613fd721ab2e1a71ee8d11346a1d1aeecab22305b71a3eb1193c92ef8598a1a9c1a289d212256b4e27eb08c
SSDEEP 384:zlfRE5BdEZfr0kuh9Rt/nP9yTNb3y0zX8Vazf3LQJ:FRkurqhNsIm8s3LQJ
TLSH
T1C9729F73863059376DE6C106394A6B0276B4805E91D17FA8ADDD6F0C0BC77D91363E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Local State
Size 16KB
SHA256 5638783c51eeee193df6ce9f5bbc983c8477f7f2672de9138e79f29e00d25eec
MD5 b407c84cadf2b150f01696544aa205b7
SHA1 cf1c162c2ad2186c55f4b61bfc78641a417b942a
SHA512 f2732c78fead91d40b7b0945e955b7124333c49cfb2fe089ece17fc2e7f2c12e2e96309273fea693a48569aeed5290a85a4e5431e6f4ed983d2fdbbe6f365c4f
SSDEEP 384:zcfRE5BdEZfr0kuh9Rt/nP9yTNb3y0zX8Vazf3LQJ:ERkurqhNsIm8s3LQJ
TLSH
T1EE729F738A3059376DE7C106394A6B0276B4805EA1D17E98ADED6F0C0BC7BD91363D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Local State
Size 3KB
SHA256 01f67787f4c2df8bfe00e7ae073a6472951bd5119cabe0fad9ae145a8071335e
MD5 617e44f21544305372170a2f2ac21b5d
SHA1 a06414d6fdd8ee6f16bb83cc3eb8a71a7bb0d78f
SHA512 f0c7f5fc6640f9dff54597f10336e34bacfff90e6cb2f072207e7654a333a23e1cd4ee4943bfe6124c29a2fdc7f3dabe1f50e5e1b15f3b45b7eeedfc214802db
TLSH
T1F671A337A86499375DE3D905B8853B067BAA112BD5D13FA8DAEC1F0C02DB38C2352D17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Local State
Size 16KB
SHA256 f828f34922570d6d4ca8980112e03e78f8898561fe303d3c29a74ae90113d553
MD5 c985b57b6071cdd0d6587d290ba4ada9
SHA1 ed9ce3fca8e1137a5d01bbf5b9d3a7194f0a1ed4
SHA512 ad7028c55c5e619629eaa091a8e423e3a912c8d27a8da1f326e7d4cd7da1b7ff1f642cd36b61601992028d6f227d81bdc89e74ba80e3145a74874485c393ba7c
SSDEEP 384:zafRE5BdEZfr0kuh9Rt/nP9yRNbay0hX8Vazf3LQJ:GRkurqhNs108s3LQJ
TLSH
T175729F738A3159376CE6C106394A6B02B6B4805E91D17F98ADEC6F0C0BC7BC91363E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Local State
Size 17KB
SHA256 95dedd69ff83b2dd908a8f0c36c3e26c6700fe847989c040a3bdd77f20462a6c
MD5 ed2e94efa7aa8d98eb6349f7fe524e87
SHA1 5ac25c7c12144a8fb85ee3bb1aba69a16efe773e
SHA512 253fdaedfbedf1dedb43d06f049e5ea000735e5696b3e69e3658107e378349463bdcf80a05b1cfbc1f666ff8a8533b2ddeeceb66b1e38fb61b69d1a83b940d52
SSDEEP 384:zbfRE5BdEZfr0kuh9Rt/nP9ymNbay0hX8VazNVb3LQJ:HRkurqhNsS08ub3LQJ
TLSH
T133827D72D93199376CE682463A0B7B02A6B4814E92D56ED8ACDC6F0C0AC7BDE1353D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe580952.TMP

Path C:\Users\Admin\AppData\Local\com.lx63.app\EBWebView\Local State~RFe580952.TMP
Size 1KB
SHA256 952bc8e9b2e83a333e7752e575731e87650f2eccf57155a5e5778e4e79facb9d
MD5 075dae216f914da5b80fb5ece9f54bcb
SHA1 77fa428ac500765879dd6bd4743e53eba337791d
SHA512 f5b8ad239a9f4b0f2072c8f0a49b4447e54fc99edb31026da345271df67acafb499f0b68ec486cb0042bc671003acaa88487dca57426b589ef076bd717fc0f00
TLSH
T141216277C4801AB2BD928846B1A1B74B3E69116F8260AF5DE5DC9B0C07DB5DE9233C33
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

RobloxPlayerInstaller.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe:Zone.Identifier
Size 171B
SHA256 243bb2214f020320abec2d97c888970cc4a46a466324cb5ef9278ebb8ced18c3
MD5 4bde3cb020bf9b481bbf0ad1ce74c66b
SHA1 93315676eabfd9cb4bf50cc7d5c1d31982b1feb6
SHA512 3c2cef81ab917b9bdd5a28a711b1656a23fecad5cc4a3aac54abaf6f986cd479bc66c80e3e7c3c3b43d3d5027ddc021e23c31648f498057a30e0479e0710c91e
TLSH
T1D6C080E28A058550351423CD33EED4AD77475615454D83D0F441A4D7554449F7660646
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 926764.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 926764.crdownload
Size 9.4MB
SHA256 b112a9fec58816f9ee176a31c0f52e3cf94b4dfec07975ed67ba9eb911fd951a
MD5 133aff3d0848579570639fe9564be495
SHA1 cdd7705ce581282e78079c55148ef4178f6cc25d
SHA512 660c2d31c79c2a9f4c49fc2482be8bc1fa2a4bd4fafce1b7f248c962759ac2e5c98f9ad48f0cb0c1a92a87453291fb776428405c89a39a8c253a78675ffff7f1
SSDEEP 196608:sfYe3Rcu2TzqUrREheMAF80c31NfEHsB1C5TJP:sOu2vl4I8H1NfEwCVJP
TLSH
T1AAA6BE22F940C031E5C102B2E6BDAFB65E7C9E240B7954C767C459BC59305E33A3AB6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_1805678211\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_199421345\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_199421345\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_2085006779\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_380949918\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4768_39700354\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1216-1711-0x0000024B2C880000-0x0000024B2C91E000-memory.dmp

Download

memory/1216-1712-0x0000024B2C920000-0x0000024B2C92C000-memory.dmp

Download

memory/2160-144-0x00007FFCCF070000-0x00007FFCCF071000-memory.dmp

Download

memory/2700-25-0x00007FFCCF070000-0x00007FFCCF071000-memory.dmp

Download

memory/2700-243-0x000001BA65FB0000-0x000001BA65FD9000-memory.dmp

Download

memory/3152-422-0x000001AC39D20000-0x000001AC39DCF000-memory.dmp

Download

memory/3360-1739-0x00000000067C0000-0x0000000006842000-memory.dmp

Download

memory/3360-1738-0x0000000000DA0000-0x0000000000DA7000-memory.dmp

Download

memory/3360-1662-0x00000000067C0000-0x0000000006842000-memory.dmp

Download

memory/3360-1661-0x0000000000DA0000-0x0000000000DA7000-memory.dmp

Download

memory/3576-244-0x000001FE47E00000-0x000001FE47EAF000-memory.dmp

Download

memory/4076-570-0x0000024835330000-0x00000248353CE000-memory.dmp

Download

memory/4768-226-0x000001AF224E0000-0x000001AF2258F000-memory.dmp

Download

memory/4884-1640-0x00000175025C0000-0x00000175025C1000-memory.dmp

Download

memory/4884-1637-0x00000175025C0000-0x00000175025C1000-memory.dmp

Download

memory/4884-1638-0x00000175025C0000-0x00000175025C1000-memory.dmp

Download

memory/4884-1639-0x00000175025C0000-0x00000175025C1000-memory.dmp

Download

memory/4884-1635-0x00000175025C0000-0x00000175025C1000-memory.dmp

Download

memory/4884-1628-0x00000175025C0000-0x00000175025C1000-memory.dmp

Download

memory/4884-1629-0x00000175025C0000-0x00000175025C1000-memory.dmp

Download

memory/4884-1630-0x00000175025C0000-0x00000175025C1000-memory.dmp

Download

memory/4884-1636-0x00000175025C0000-0x00000175025C1000-memory.dmp

Download

memory/4884-1634-0x00000175025C0000-0x00000175025C1000-memory.dmp

Download

memory/5048-225-0x000001F9E3280000-0x000001F9E332F000-memory.dmp

Download

memory/5776-1769-0x0000020F9B4C0000-0x0000020F9B4CC000-memory.dmp

Download

memory/5776-1768-0x0000020F9B590000-0x0000020F9B62E000-memory.dmp

Download