Overview

overview

8

Static

static

3

RobloxPlay...3R.exe

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    599s
  • max time network
    600s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250610-en
  • resource tags

    arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    11/05/2026, 03:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RobloxPlayerInstaller-89VKJDPH3R.exe
  • Size 9.5MB
  • Sample260511-d18gjsd16j
  • SHA256 678ae020d6515bcf2fd2d134cee653cc5def813832b91f26f166e12cd6bf121a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationspywaretrojan

Malware Config

Signatures

  • Downloads MZ/PE file 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 25 IoCs
  • Loads dropped DLL 14 IoCs
  • Modifies system executable filetype association 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 30 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 11 IoCs
  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller-89VKJDPH3R.exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller-89VKJDPH3R.exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    PID:2084
    • C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\RobloxPlayerBeta.exe
      "C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 2084
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:4704
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2896
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5176
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27097 -prefMapHandle 1980 -prefMapSize 270279 -ipcHandle 2068 -initialChannelId {08835467-b5e9-4f4b-a083-80301666c9bf} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        3⤵
          PID:5008
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {a001efb4-2301-44fd-80e6-a35b6a669822} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
          3⤵
          • Checks processor information in registry
          PID:4940
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3972 -prefsLen 27323 -prefMapHandle 3976 -prefMapSize 270279 -jsInitHandle 3980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3988 -initialChannelId {de5fcac2-2c83-4e3d-a59b-201f46b45070} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
          3⤵
          • Checks processor information in registry
          PID:4540
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4172 -prefsLen 27323 -prefMapHandle 4176 -prefMapSize 270279 -ipcHandle 4192 -initialChannelId {542fbdb1-8db8-4af3-adb9-c15ee84c19e0} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
          3⤵
            PID:1188
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3824 -prefsLen 34822 -prefMapHandle 3828 -prefMapSize 270279 -jsInitHandle 2672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2624 -initialChannelId {9bec7395-2c49-42e2-bde5-52aab3434013} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
            3⤵
            • Checks processor information in registry
            PID:2108
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4632 -prefsLen 34822 -prefMapHandle 4620 -prefMapSize 270279 -ipcHandle 1668 -initialChannelId {1ed43011-5a7b-4e67-bf6a-571fe3527e35} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
            3⤵
            • Checks processor information in registry
            PID:956
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5536 -prefsLen 32952 -prefMapHandle 5540 -prefMapSize 270279 -jsInitHandle 5544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3388 -initialChannelId {01e4a8ec-d3b3-4a46-9816-c6130119574c} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
            3⤵
            • Checks processor information in registry
            PID:3344
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5516 -prefsLen 32952 -prefMapHandle 2780 -prefMapSize 270279 -jsInitHandle 4724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3076 -initialChannelId {c78c815a-68a0-4a1a-aa46-224412bdae64} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
            3⤵
            • Checks processor information in registry
            PID:4580
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5872 -prefsLen 32952 -prefMapHandle 5876 -prefMapSize 270279 -jsInitHandle 5880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4724 -initialChannelId {32173e2f-6320-4728-ab60-a7f3636cd63a} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
            3⤵
            • Checks processor information in registry
            PID:684
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5540 -prefsLen 32952 -prefMapHandle 2636 -prefMapSize 270279 -jsInitHandle 2660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4664 -initialChannelId {b68b4866-c386-45c0-b606-8259f66efda6} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
            3⤵
            • Checks processor information in registry
            PID:5144
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5876 -prefsLen 32952 -prefMapHandle 5880 -prefMapSize 270279 -jsInitHandle 5864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5868 -initialChannelId {d1d35f11-9d09-44da-8285-6563f10f7120} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
            3⤵
            • Checks processor information in registry
            PID:3568
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6216 -prefsLen 32952 -prefMapHandle 6220 -prefMapSize 270279 -jsInitHandle 6224 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6232 -initialChannelId {08a53d6e-444f-4367-95bd-a43cc7faab15} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
            3⤵
            • Checks processor information in registry
            PID:5692
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6404 -prefsLen 32952 -prefMapHandle 6408 -prefMapSize 270279 -jsInitHandle 6412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6216 -initialChannelId {dd6e4e03-0523-423b-9158-7ae09deb3506} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
            3⤵
            • Checks processor information in registry
            PID:4164
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6424 -prefsLen 32952 -prefMapHandle 2616 -prefMapSize 270279 -jsInitHandle 6512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6588 -initialChannelId {abfb1532-340c-44c2-b4fe-1350f0492b4a} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
            3⤵
            • Checks processor information in registry
            PID:3444
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6756 -prefsLen 32952 -prefMapHandle 6760 -prefMapSize 270279 -jsInitHandle 6764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6772 -initialChannelId {5c4d02bb-5853-4282-b108-8b563c4871aa} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
            3⤵
            • Checks processor information in registry
            PID:1944
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6920 -prefsLen 32952 -prefMapHandle 6924 -prefMapSize 270279 -jsInitHandle 6928 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6936 -initialChannelId {7bfd422b-229d-481e-84ed-5b9e90774b22} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
            3⤵
            • Checks processor information in registry
            PID:3108
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7104 -prefsLen 32952 -prefMapHandle 7108 -prefMapSize 270279 -jsInitHandle 7112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7120 -initialChannelId {fa234c25-c3f6-4743-bacf-364f9d3a5106} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
            3⤵
            • Checks processor information in registry
            PID:5452
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7288 -prefsLen 32952 -prefMapHandle 7292 -prefMapSize 270279 -jsInitHandle 7296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7304 -initialChannelId {3a245282-7562-4276-a10f-cc0926fc8256} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
            3⤵
            • Checks processor information in registry
            PID:1032
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7464 -prefsLen 32952 -prefMapHandle 7468 -prefMapSize 270279 -jsInitHandle 7472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7480 -initialChannelId {f6a39d6a-07e5-4c60-b4dc-d9668f5d7899} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
            3⤵
            • Checks processor information in registry
            PID:1028
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7680 -prefsLen 32952 -prefMapHandle 7684 -prefMapSize 270279 -jsInitHandle 7688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7468 -initialChannelId {b3a50367-b499-4f1c-a7a2-afc6396c45b7} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
            3⤵
            • Checks processor information in registry
            PID:5940
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5204 -prefsLen 32952 -prefMapHandle 5196 -prefMapSize 270279 -jsInitHandle 7760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7836 -initialChannelId {db104487-fccf-4307-bfbc-e764ed0835db} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
            3⤵
              PID:5932
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8004 -prefsLen 32952 -prefMapHandle 8008 -prefMapSize 270279 -jsInitHandle 8012 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8020 -initialChannelId {3f4e96fd-c328-4013-bb01-425c7395a14b} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
              3⤵
              • Checks processor information in registry
              PID:5900
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8196 -prefsLen 32952 -prefMapHandle 8200 -prefMapSize 270279 -jsInitHandle 8204 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8212 -initialChannelId {a94f2f5b-bc85-417d-aad8-fefd8765b53c} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
              3⤵
              • Checks processor information in registry
              PID:1620
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8384 -prefsLen 32952 -prefMapHandle 8388 -prefMapSize 270279 -jsInitHandle 8392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8400 -initialChannelId {7d5f2393-108d-4251-b0f3-abf72f65d69e} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab
              3⤵
              • Checks processor information in registry
              PID:2128
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2840 -prefsLen 32952 -prefMapHandle 8400 -prefMapSize 270279 -jsInitHandle 8392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8604 -initialChannelId {730e54d3-bd9b-42fe-b0c5-38c8d7e1db26} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab
              3⤵
              • Checks processor information in registry
              PID:1120
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2676 -prefsLen 32952 -prefMapHandle 3240 -prefMapSize 270279 -jsInitHandle 5432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8680 -initialChannelId {4daf8bb1-03dd-4bc2-94ca-0c47a9caa425} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab
              3⤵
              • Checks processor information in registry
              PID:4036
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8848 -prefsLen 32952 -prefMapHandle 8852 -prefMapSize 270279 -jsInitHandle 8856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5760 -initialChannelId {6aa50ca3-2865-4523-9204-920470dae398} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab
              3⤵
              • Checks processor information in registry
              PID:4856
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5712 -prefsLen 32952 -prefMapHandle 5716 -prefMapSize 270279 -jsInitHandle 5448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9004 -initialChannelId {9bfbab5e-b72c-4f0c-8277-228bf52fcd8b} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab
              3⤵
              • Checks processor information in registry
              PID:3184
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5732 -prefsLen 32952 -prefMapHandle 5720 -prefMapSize 270279 -jsInitHandle 5696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9160 -initialChannelId {cdc87a60-9c33-464a-a158-cfa36222dec7} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab
              3⤵
              • Checks processor information in registry
              PID:5568
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5628 -prefsLen 32952 -prefMapHandle 5632 -prefMapSize 270279 -jsInitHandle 5616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5604 -initialChannelId {ec8225ab-8675-468f-81fc-d82de49b5bf9} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab
              3⤵
              • Checks processor information in registry
              PID:1488
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9272 -prefsLen 32952 -prefMapHandle 9276 -prefMapSize 270279 -jsInitHandle 9280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9288 -initialChannelId {e5981d74-da61-4ed2-91e2-4715bbe4362f} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab
              3⤵
              • Checks processor information in registry
              PID:2508
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9460 -prefsLen 32952 -prefMapHandle 9464 -prefMapSize 270279 -jsInitHandle 9468 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9476 -initialChannelId {d3c01e81-3ef8-478b-a26a-7e248cdf7e04} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 32 tab
              3⤵
                PID:5472
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9648 -prefsLen 32952 -prefMapHandle 9652 -prefMapSize 270279 -jsInitHandle 9656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9664 -initialChannelId {153dc80d-f3e2-4f57-b6eb-cf7d38ae9de6} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 33 tab
                3⤵
                • Checks processor information in registry
                PID:5240
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9840 -prefsLen 32952 -prefMapHandle 9844 -prefMapSize 270279 -jsInitHandle 9848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9856 -initialChannelId {a0e13959-d393-48ed-a289-c4ff453cff4e} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 34 tab
                3⤵
                • Checks processor information in registry
                PID:2328
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10048 -prefsLen 32952 -prefMapHandle 10052 -prefMapSize 270279 -jsInitHandle 10056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10060 -initialChannelId {2826ef09-58dd-48b9-a790-dd474c113418} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 35 tab
                3⤵
                • Checks processor information in registry
                PID:3976
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10232 -prefsLen 32952 -prefMapHandle 10236 -prefMapSize 270279 -jsInitHandle 10244 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10252 -initialChannelId {f13d9b1e-264c-4830-9345-4d777240abe5} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 36 tab
                3⤵
                  PID:1492
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10424 -prefsLen 32952 -prefMapHandle 10428 -prefMapSize 270279 -jsInitHandle 10432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10440 -initialChannelId {ca20b111-56a4-42e3-8d26-e12ecf9669bd} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 37 tab
                  3⤵
                  • Checks processor information in registry
                  PID:480
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10612 -prefsLen 32952 -prefMapHandle 10616 -prefMapSize 270279 -jsInitHandle 10620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10628 -initialChannelId {dd61d127-c9db-4313-818a-4a41a0f7d321} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 38 tab
                  3⤵
                  • Checks processor information in registry
                  PID:5496
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10828 -prefsLen 32952 -prefMapHandle 10832 -prefMapSize 270279 -jsInitHandle 10836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10616 -initialChannelId {516b3e6e-5d53-405f-af8b-20bda6e58cdd} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 39 tab
                  3⤵
                  • Checks processor information in registry
                  PID:3580
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11004 -prefsLen 32952 -prefMapHandle 11008 -prefMapSize 270279 -jsInitHandle 11012 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11020 -initialChannelId {ed6a5182-185f-4f67-8c7a-44622d8761d3} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 40 tab
                  3⤵
                  • Checks processor information in registry
                  PID:3880
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11204 -prefsLen 32952 -prefMapHandle 11208 -prefMapSize 270279 -jsInitHandle 11212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11220 -initialChannelId {14d6287a-a0e6-4dc5-a704-e51b4f995bbb} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 41 tab
                  3⤵
                    PID:1308
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11368 -prefsLen 32952 -prefMapHandle 11372 -prefMapSize 270279 -jsInitHandle 11376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11384 -initialChannelId {032eb942-5b66-4f54-b2bb-9beb3a89f4fd} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 42 tab
                    3⤵
                    • Checks processor information in registry
                    PID:4040
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11556 -prefsLen 32952 -prefMapHandle 11560 -prefMapSize 270279 -jsInitHandle 11564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11572 -initialChannelId {de07f2af-ad45-4c63-af1e-7ba680bb3111} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 43 tab
                    3⤵
                    • Checks processor information in registry
                    PID:5736
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11744 -prefsLen 32952 -prefMapHandle 11748 -prefMapSize 270279 -jsInitHandle 11752 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11760 -initialChannelId {01df2a12-0dd0-4029-b193-6c5418a98eaf} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 44 tab
                    3⤵
                    • Checks processor information in registry
                    PID:5928
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11952 -prefsLen 32952 -prefMapHandle 11956 -prefMapSize 270279 -jsInitHandle 11960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11788 -initialChannelId {08bd578b-fbb3-4389-beba-95aac502a01b} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 45 tab
                    3⤵
                    • Checks processor information in registry
                    PID:1448
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12124 -prefsLen 32952 -prefMapHandle 12128 -prefMapSize 270279 -jsInitHandle 12132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12136 -initialChannelId {0c61e197-fcfa-4bb6-a783-8db5b3a4085f} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 46 tab
                    3⤵
                    • Checks processor information in registry
                    PID:5200
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12312 -prefsLen 32952 -prefMapHandle 12316 -prefMapSize 270279 -jsInitHandle 12320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12328 -initialChannelId {7d2be507-36a4-4b98-b0d2-efeb5f94faee} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 47 tab
                    3⤵
                    • Checks processor information in registry
                    PID:2060
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10416 -prefsLen 32952 -prefMapHandle 10420 -prefMapSize 270279 -jsInitHandle 10016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9848 -initialChannelId {a88d5008-caeb-4532-872f-091e17ab8ccf} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 48 tab
                    3⤵
                    • Checks processor information in registry
                    PID:3260
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                1⤵
                • Drops file in Windows directory
                • Enumerates system info in registry
                • Modifies data under HKEY_USERS
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:3896
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x84,0x88,0xe4,0x80,0x108,0x7ffeb4c2dcf8,0x7ffeb4c2dd04,0x7ffeb4c2dd10
                  2⤵
                    PID:1896
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1952,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=1948 /prefetch:2
                    2⤵
                      PID:1972
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1776,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=1984 /prefetch:11
                      2⤵
                      • Downloads MZ/PE file
                      PID:4376
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2344,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=2440 /prefetch:13
                      2⤵
                        PID:2568
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3188,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=3440 /prefetch:1
                        2⤵
                          PID:7352
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3196,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=3460 /prefetch:1
                          2⤵
                            PID:7360
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4196,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4216 /prefetch:9
                            2⤵
                              PID:7424
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4500,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4548 /prefetch:1
                              2⤵
                                PID:7844
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=5284,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5296 /prefetch:14
                                2⤵
                                  PID:5260
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=5476,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5488 /prefetch:14
                                  2⤵
                                    PID:3268
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5672,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5288 /prefetch:1
                                    2⤵
                                      PID:2880
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5660,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5624 /prefetch:1
                                      2⤵
                                        PID:1352
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --field-trial-handle=3432,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=3476 /prefetch:12
                                        2⤵
                                          PID:6776
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=5536,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5896 /prefetch:14
                                          2⤵
                                            PID:7272
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=5516,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=3064 /prefetch:14
                                            2⤵
                                              PID:7956
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=4636,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6020 /prefetch:14
                                              2⤵
                                                PID:7724
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=4692,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6072 /prefetch:14
                                                2⤵
                                                  PID:7876
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=6032,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6064 /prefetch:14
                                                  2⤵
                                                    PID:1532
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=3844,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4548 /prefetch:14
                                                    2⤵
                                                      PID:5420
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=6064,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=3444 /prefetch:14
                                                      2⤵
                                                        PID:6428
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=6016,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5920 /prefetch:14
                                                        2⤵
                                                          PID:3472
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=4240,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4312 /prefetch:1
                                                          2⤵
                                                            PID:7268
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=4504,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=3172 /prefetch:9
                                                            2⤵
                                                              PID:7500
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=3520,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6028 /prefetch:1
                                                              2⤵
                                                                PID:7944
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=224,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4288 /prefetch:14
                                                                2⤵
                                                                • NTFS ADS
                                                                PID:836
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=5828,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6168 /prefetch:1
                                                                2⤵
                                                                  PID:6292
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=6240,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6236 /prefetch:1
                                                                  2⤵
                                                                    PID:2316
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=6392,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6388 /prefetch:10
                                                                    2⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:5780
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=6576,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6528 /prefetch:1
                                                                    2⤵
                                                                      PID:7548
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=6356,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6656 /prefetch:1
                                                                      2⤵
                                                                        PID:6528
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=6772,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6788 /prefetch:1
                                                                        2⤵
                                                                          PID:4584
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=6956,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6608 /prefetch:1
                                                                          2⤵
                                                                            PID:7736
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --string-annotations --field-trial-handle=6596,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=3828 /prefetch:14
                                                                            2⤵
                                                                              PID:6348
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=5568,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4260 /prefetch:1
                                                                              2⤵
                                                                                PID:7104
                                                                              • C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\RobloxPlayerBeta.exe
                                                                                "C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:_o9LOmX01uKGUwFpB59oL4SS16qo27N10PhxtlGdKagcRGuRYnwNl644nDIUOUzf2CiWq0vjQbIIxAP8kzWAK56GfjzfZyEzSB1Uv_TE0I_QkkGpoJSEnL9LD5J7LdDQ_7o6Zl0hzpR2zmKda2122ypcES1jYpGwzMk74Ysqef90z6WQEyeLUthkHg_opMDMlIz3RDYcgon2K7rYU3ZiaY-9RL3V790xPPKvturOvCA_FbaTjWK8t9SdoAddd2p69Zd78YqsCK9rxFCCnytFcrjzaTrefQApGFoGrbB4c_I2l1OWpMqHtwbG8872odLF22V4QisAa0O29gFsFtafn1S0aiQYeRewAcYgKMCXzPGksOcRsWfxTKmISte1YuuMmH_Dp6RUpSjP3JhwWhggM7z2-sG2NsCkEGIeIEZEwfzmnjz50lduJleuFJSgTH8YUngeyR7LxDi5zaR495xxn_j971NJweF3aTPWEst7_cIsL8LyWuh-7w_oWokoF-NsJyO80oZKURYI0BEodgCQmNvNk7jiD6_HyFB2fcC2yiM+launchtime:1778470560092+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1778470376391001%26placeId%3D131117978948830%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D431673c2-e605-45a0-8d47-4ba2907d8478%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1778470376391001+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
                                                                                2⤵
                                                                                • Executes dropped EXE
                                                                                • Loads dropped DLL
                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                PID:7576
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=6748,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6736 /prefetch:14
                                                                                2⤵
                                                                                  PID:5648
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=5624,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5968 /prefetch:14
                                                                                  2⤵
                                                                                  • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                  • NTFS ADS
                                                                                  PID:2348
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=6108,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=5868 /prefetch:1
                                                                                  2⤵
                                                                                    PID:5088
                                                                                  • C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\RobloxPlayerBeta.exe
                                                                                    "C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:0FDEPLjg5QeHZr4EW61sPMbEE7mJTKa-1B8dDDVxPU0_2lQ3N7jkiy3izL_VkhOyu0Xcg2EWPQAwyfW7wqDCVfL-CvjXUNU-Urq4d8ZFtHBQnkbpp-lHmTmV2JB26Hrj8D-RqzgnCauEiYDxfDXRcC0J35vZq5hd-_W09I-UrXk7hbDtr-FZhEAD_Dgvg2xOf_qPLE7pOu49hx8F_aSXrZpqs1IqnfXDXhp_3yzLRNFbV2-kJuvYwlVgXOpeTB0IikP972x--xjhQgct0Z1ptTu48WmGlu5JcPIL0hnLSlFWOpXLpVKF5dHNfmqopYu1qv8jw_q_7Iua_9yqGWlNElMUJDtHdTIpZhbNsshEGreKoRxy9wc5hFHB5tw0O-OQ6LrkM9QXei-GcI8VVVEGKfLOgC1dYXo-BoQA9fsuT8aEYcUIuDtquvzWAGT3QTpTxJIn9CBR83TVKSV09RMjzEQTD2NwjK_rHll_GlVooOVIx8vFtKsHatXKlvwFdwFNvOgJa3Pa-GpAKfzeq36PsaQ6RyaPZ_BfbND-sU9VtBs+launchtime:1778470650675+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1778470376391001%26placeId%3D131117978948830%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3Dcbd178c5-78d6-4db5-92f7-f451e8907619%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1778470376391001+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    • Loads dropped DLL
                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:4204
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=4260,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=6768 /prefetch:1
                                                                                    2⤵
                                                                                      PID:6136
                                                                                    • C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\RobloxPlayerBeta.exe
                                                                                      "C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:j1_i4jvr5mxOhQDz2t5H8N0ZqnE7iQ1Gb4156_eHKcLoUHZZMoUxpXnlmuq6N-eFTUporws-uArZsqZrxzQ4MrfVbUspgsUoXfdwS0E_TRvI6jsJ8TCK-22wMO13YyGIeSlHtCtvQBxgBZ1zONPTdExqE4cxRXc8b4f3AzKp5A260-Qg-sWivYU0zl_LNyzUvi4hrKcCA2RammMKWTNw8LAOmmr7YwCPTrm19CDqHrZByDBays3gu5ZwYG5LpbTFFcoifrMmirn2B8SzFQIa4X3ZYSqdF0OtFbm9v8eHVWvMjHCGOUozEcpPMJ_wjHgC7Qw44X5v-MbfX3ERyLXCfio9tPrfA6nhkmBv2dS-uoDiljtiMpiXmgXLiwzL0HlbCkHTQxzAhLUlYKzqaC8MCV-T4J87IdEiBMJ8souvKSgKSfXsLy8o9Yyn9rXRosDLzWIZbVumndjMwDXxziQnbINBeRVSaC4yNH3MEIFmG26ZVzKUahKtY08CHDP8CxC9gCooPVlzXYsH_ZN835V4I6uMIBZF5rm_OiASwXPDMlk+launchtime:1778470651446+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1778470376391001%26placeId%3D131117978948830%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D941c5b8d-3b4b-4051-9aee-fe020f95ed9d%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1778470376391001+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      • Loads dropped DLL
                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:7148
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=6636,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=7056 /prefetch:1
                                                                                      2⤵
                                                                                        PID:7008
                                                                                      • C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\RobloxPlayerBeta.exe
                                                                                        "C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:bbwJzK-VTXRMAqUXoN-WQ9DICpTRUhceuaofDNBoz8dLGMh1IKEwLLHfQ9hKqluF0y_SNNgMgnnmfAqPGxhMksqYCYx0EWNxxsb7L0hqfehnvgL8ZcCi0_q0QL_57uNmSkDcV4JJpJfP8INHsDwAwnES23KrZLR3RoIIzt3FF3vH3ZcwP0DKPFX-laqvqRdXBLw39jQqeUF6EdEqKahh47OwymArq6os2r1ui9nxOp8oCcuVAgbkbgO60u2BoB0Tpt8fUOaDWWZ8tqPexP3d27FAlGD5Dr44xw5tk0SqwNpZwGVWH6DqNOk-ttYL-ORY-yfWqyCLmSgLVXqd7Mo2evKwud6BSrQuydoy6_GZsPmNSynoLgD3I9KmUVXtbvM7PjJJrjrpVZXxNEbtp6gXZk5z50KnuAHQAxasgAfrvpzvI4S_M8niyY-D7xnb-0aH6TxkPAhfdug-orlfm6COtOb2-1T-7c2h4SGzLSh5-SixUqHBF-blCX6mkiQu-ntzXig-fxyTWGsH9amp0vI37PLLgePGeXiLpoxoQAkXLkU+launchtime:1778470740685+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1778470376391001%26placeId%3D131117978948830%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3Dbc2d1362-29f1-40df-9102-2c4d4e01b842%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1778470376391001+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        • Loads dropped DLL
                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        PID:4996
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=4288,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=4244 /prefetch:1
                                                                                        2⤵
                                                                                          PID:5008
                                                                                        • C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\RobloxPlayerBeta.exe
                                                                                          "C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:6Hm9ICwimIL_UU6p4A6Ze94DLLsFO_JO77bPK3OlfLpQmt72IkGSwKlV2kFx9WIZhRcLikav7139C_N0SPrbxOBVd-IiHjC07n2MF8VNt_pv2FF8AcQR5Uc1kA-sqKfzgZBAwxL4fnYkNKCUc1mVIfnfZF1KQhwhSitBN-iZEBmqzwavxtWuRG9vzg-500sbbRyv3qVCmBfu2jdBAjv0dgOGjvHwmdJljcJZTs15Pj4mt8c6tc8P4_J4lpT6QGqoJRlE2gHcvQ2WPqEp3P95Yc3YELNKn3JQ6WyiqpP0JfkIeb_C_mdeNcqSz5-IzC7oRP7pCDrOc5AHMTvxhZ1_3FFBl8tE_POngiFDsQ4y0BgBjSjDLxyIJ1tIEdsLPv_bbw1mgQ3cR1vi6bpz1vjepUw_EyH935oULlo--Kk1KQa6tesESnUo_Yzdt4GzeOvjcdwcMVPc5-tP10BAxbEavk3IV9m3VqwtNXCUUpdrqrhnGbfwKa14CAY58AT_zJ67dQmVGIfA2a3MXwHeqUW2gjajPgvXLef6X0K9VM-RA0A+launchtime:1778470749268+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1778470376391001%26placeId%3D131117978948830%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3Df5f0059a-cf74-4f2c-bb02-29eb185c5186%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1778470376391001+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:4952
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=2244,i,10328454714564192560,13053754075934691459,262144 --variations-seed-version=20250610-180047.803000 --mojo-platform-channel-handle=7256 /prefetch:1
                                                                                          2⤵
                                                                                            PID:5944
                                                                                          • C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\RobloxPlayerBeta.exe
                                                                                            "C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:3TUPQrH6eQUb10JEHUB43ePzrWWkMvVnosJ1RRuKZ2dbmLv87UcCZZjN-AW8guqLuvNu6RSAyQJZ8SKhi1n1JPTSZWYXpjZ7v7Yxlbh4dbWPZDsl0mDBwUKGzS3FuP4htI3FSsPYW1GfQVC6ZB7E4Ok-xAMU_8qyDoQK2FqUds065U__Ez2ArXFaW5-rlro_v-LIbdXGDpe-eipW0PiiMJkOGcD9NO3ZX2Lm0_N2lz1LaN0diLCU5DJcVOFKrZs1o5RLvcXA6NsUEN1Pik3jaRbWyBFgh2Fx2h2ihSN68A5C_WVcp36tYzBR5xB8TBx6blrenio6jEMCJqAHlJ6MNwdvKYcPaE4ukDFIZYsx7u8Op5CMZiYezNG6j_YU9PSyaiMZEE4Ex9EjAUr2N7EJtfjVHf49qUPKqgRYspvwPy6JN-7gJoMIXM5HhFCiowGEdmigeL-cGcsH1nAAiFgSI9xLFFBGNjLCqR5T-uU1F4pbnXZTmlQd4gNlwNTShMeSQ_77DlNBzrltJpzm0L6nnW9DyhrUQ97YOn0i9RSKOtA+launchtime:1778470756990+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1778470376391001%26placeId%3D131117978948830%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D06fd66ec-76b7-4172-a762-02d80f50069f%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1778470376391001+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:1252
                                                                                        • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                          1⤵
                                                                                            PID:3440
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                            1⤵
                                                                                              PID:6092
                                                                                            • C:\Windows\system32\AUDIODG.EXE
                                                                                              C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004E8
                                                                                              1⤵
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:3108
                                                                                            • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                              "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
                                                                                              1⤵
                                                                                              • Modifies registry class
                                                                                              PID:3332
                                                                                            • C:\Windows\System32\rundll32.exe
                                                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                              1⤵
                                                                                                PID:3772
                                                                                              • C:\Users\Admin\Downloads\RobloxPlayerInstaller-9926KFPYGT.exe
                                                                                                "C:\Users\Admin\Downloads\RobloxPlayerInstaller-9926KFPYGT.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Checks whether UAC is enabled
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Enumerates system info in registry
                                                                                                • Modifies Internet Explorer settings
                                                                                                • Modifies registry class
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                PID:6764
                                                                                                • C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\RobloxPlayerBeta.exe
                                                                                                  "C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\RobloxPlayerBeta.exe" -personalizedToken 9926KFPYGT --deeplink https://www.roblox.com/games/131117978948830/DMvsS -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 6764
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:2096
                                                                                              • C:\Users\Admin\Downloads\winrar-x64-722.exe
                                                                                                "C:\Users\Admin\Downloads\winrar-x64-722.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Program Files directory
                                                                                                • Modifies Internet Explorer settings
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:5856
                                                                                                • C:\Program Files\WinRAR\uninstall.exe
                                                                                                  "C:\Program Files\WinRAR\uninstall.exe" /setup
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Modifies system executable filetype association
                                                                                                  • Modifies registry class
                                                                                                  PID:7444
                                                                                                  • C:\Program Files\WinRAR\RarExtInstaller.exe
                                                                                                    "C:\Program Files\WinRAR\RarExtInstaller.exe" -install
                                                                                                    3⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:4280
                                                                                              • C:\Program Files\WinRAR\RarExtInstaller.exe
                                                                                                "C:\Program Files\WinRAR\RarExtInstaller.exe" /install /local
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:5936
                                                                                              • C:\Program Files\WinRAR\WinRAR.exe
                                                                                                "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Release.zip"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Modifies registry class
                                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                                PID:3240
                                                                                                • C:\Program Files\WinRAR\RarExtInstaller.exe
                                                                                                  "C:\Program Files\WinRAR\RarExtInstaller.exe" -install
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:2960
                                                                                              • C:\Program Files\WinRAR\WinRAR.exe
                                                                                                "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Release.rar"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                                PID:1112
                                                                                              • C:\Program Files\WinRAR\WinRAR.exe
                                                                                                "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Release.rar"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                                • NTFS ADS
                                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                                PID:2276
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Rar$EXa2276.27792.rartemp\Release\basebutyeaaa.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Rar$EXa2276.27792.rartemp\Release\basebutyeaaa.exe"
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:1420
                                                                                              • C:\Windows\system32\AUDIODG.EXE
                                                                                                C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004E8
                                                                                                1⤵
                                                                                                  PID:1248
                                                                                                • C:\Users\Admin\Downloads\RobloxPlayerInstaller-9926KFPYGT.exe
                                                                                                  "C:\Users\Admin\Downloads\RobloxPlayerInstaller-9926KFPYGT.exe"
                                                                                                  1⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Checks whether UAC is enabled
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Enumerates system info in registry
                                                                                                  • Modifies Internet Explorer settings
                                                                                                  • Modifies registry class
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:5420
                                                                                                  • C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\RobloxPlayerBeta.exe
                                                                                                    "C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 5420
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Loads dropped DLL
                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:7132
                                                                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                                                                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                                                                                                  1⤵
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:856
                                                                                                • C:\Users\Admin\Downloads\RobloxPlayerInstaller-9926KFPYGT.exe
                                                                                                  "C:\Users\Admin\Downloads\RobloxPlayerInstaller-9926KFPYGT.exe"
                                                                                                  1⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Checks whether UAC is enabled
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Enumerates system info in registry
                                                                                                  • Modifies Internet Explorer settings
                                                                                                  • Modifies registry class
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:6296
                                                                                                  • C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\RobloxPlayerBeta.exe
                                                                                                    "C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 6296
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Loads dropped DLL
                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:6336
                                                                                                • C:\Program Files\WinRAR\WinRAR.exe
                                                                                                  "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Release\Release.rar"
                                                                                                  1⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                  PID:1220
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Rar$EXa1220.40071.rartemp\Release\basebutyeaaa.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Rar$EXa1220.40071.rartemp\Release\basebutyeaaa.exe"
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:4180
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Rar$EXa1220.40715.rartemp\Release\basebutyeaaa.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Rar$EXa1220.40715.rartemp\Release\basebutyeaaa.exe"
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:5500

                                                                                                Network

                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      RobloxStudioInstaller.exe
                                                                                                      • Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
                                                                                                      • Size 9.7MB
                                                                                                      • SHA256 1903289172692e64ea90f9e12d40aa15966eee72ac15fe5f01b633970f2e7401
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      RobloxPlayerBeta.dll
                                                                                                      • Path C:\Program Files (x86)\Roblox\Versions\version-bf6344c9c23446bf\RobloxPlayerBeta.dll
                                                                                                      • Size 20.3MB
                                                                                                      • SHA256 83ae55acd7112ff18b2a26158b719dcabf5b02d649e051c9e2b6bd2601212645
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Uninstall.exe
                                                                                                      • Path C:\Program Files\WinRAR\Uninstall.exe
                                                                                                      • Size 402KB
                                                                                                      • SHA256 b35ff0d49825c222aa5af767b2ea6d04c5324b8c2de68e2d7b257bf8f2dedf87
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      BrowsingTopicsState
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                      • Size 414B
                                                                                                      • SHA256 ae3e7440e7ca67208e5214c997c8b3e8966eea5de267ed62c16c99ae88224c37
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      f_000099
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000099
                                                                                                      • Size 18KB
                                                                                                      • SHA256 a82d1ffda93f1b5fe35e8898a59a58d907ff6f4877ce05aa15894a8b75f7ab67
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      f_00009a
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00009a
                                                                                                      • Size 19KB
                                                                                                      • SHA256 644f835ccecf323a66393efcfb72110c17bbbc83367b8b861c571e6fd75995a0
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      f_00009b
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00009b
                                                                                                      • Size 24KB
                                                                                                      • SHA256 388efd189c053582dc9d5212352fc823f5e74136acb52d21505470e62010e220
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      f_00009f
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00009f
                                                                                                      • Size 104KB
                                                                                                      • SHA256 788d47559ba23fa062ec45d28033b7f1c89d963f12da179acb72ef03b381d12f
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      f_0000d8
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000d8
                                                                                                      • Size 51KB
                                                                                                      • SHA256 bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                      • Size 15KB
                                                                                                      • SHA256 91d1c49d2f7d0627efeac12801e423ca1d1951498fd22b56195807d4276a20d0
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                      • Size 15KB
                                                                                                      • SHA256 2a197e68c139959ebbc564d298820602aca3f64625334cb9f1a319e97234c7ad
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                      • Size 11KB
                                                                                                      • SHA256 617568014bd8486b5d7fd3aa4eb14f63e39da4712be2c16b6a31b485eecb406f
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                      • Size 16KB
                                                                                                      • SHA256 a211295c9a171841aa8abfc5b65af5928f8dab049ddf59f7d38eb7fbfa5ca687
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                      • Size 15KB
                                                                                                      • SHA256 0d34c38df1a02feae9566c2e3f0bcfeb3ac3118e30058f342f349589c505d57d
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                      • Size 6KB
                                                                                                      • SHA256 220b6d3a7d7681975f79d71f756f82d3eeb5a814fa8f3f21cdf50ad18ebd71d2
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir\the-real-index
                                                                                                      • Size 96B
                                                                                                      • SHA256 96b1f4f4c4140edd280a1d106ce742e988acde7c74234a13cd25230d7317c411
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      dasherSettingSchema.json
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
                                                                                                      • Size 854B
                                                                                                      • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      000003.log
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000003.log
                                                                                                      • Size 134KB
                                                                                                      • SHA256 44f820ee758eb2b710c25bbe315e67af0a3b3245aca7162d5b0b835cb0db2aec
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      CURRENT
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
                                                                                                      • Size 16B
                                                                                                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                      • MD5 SHA1 SHA512
                                                                                                      Submit Download

                                                                                                      LOG
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG
                                                                                                      • Size 347B
                                                                                                      • SHA256 c1334344e4ae1ff18789f66554714de91f81f4b6fd918e72d635c15a40472858
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      LOG
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG
                                                                                                      • Size 387B
                                                                                                      • SHA256 e5d3de2a407285f16178b033768cf80230a1a6e9f4dbd406d1d632c76fb83ed5
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      LOG
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG
                                                                                                      • Size 387B
                                                                                                      • SHA256 d8e24ee332596283e394f2245e98db99a649984216628c7f3fb8f9682949fdde
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      MANIFEST-000001
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
                                                                                                      • Size 23B
                                                                                                      • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                                                                      • MD5 SHA1 SHA512
                                                                                                      Submit Download

                                                                                                      Network Persistent State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                      • Size 7KB
                                                                                                      • SHA256 9a6641f062806f5e5f02f00d32df7f14d48b968bfdf33b0c3085d1cc7585667c
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Network Persistent State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                      • Size 13KB
                                                                                                      • SHA256 982346043f91d7b71b58ef063b3eb9edbc54468caad8d54f6f7bc837f70e3133
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Network Persistent State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                      • Size 12KB
                                                                                                      • SHA256 80b91384a6c8f9fed2d66a59226871d71da762314ae40730d45a8c25a2b63980
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Network Persistent State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                      • Size 11KB
                                                                                                      • SHA256 d3ef16155d85328b650014204a9cbdf3694d85e54e5662644af37f52fe09be62
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Network Persistent State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                      • Size 12KB
                                                                                                      • SHA256 2673a57818bf57995d6dda5bda6ce18acffb273ecc94106f4d4819d20802d8f4
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Network Persistent State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                      • Size 6KB
                                                                                                      • SHA256 a96f2a0c912773b4011fa607e8c6ae5bb2c569cbaf83da79e69b58588eddf148
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Network Persistent State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                      • Size 14KB
                                                                                                      • SHA256 041957a3e3a5a899527941b62e8c0ecd67222ea4756110076398b770a7b1861d
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      SCT Auditing Pending Reports
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                      • Size 2B
                                                                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                      • MD5 SHA1 SHA512
                                                                                                      Submit Download

                                                                                                      Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                      • Size 12KB
                                                                                                      • SHA256 b40d68ae9422b348ee8f1ba36f8f7896d8e1fafb973222021860d78a69303800
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                      • Size 12KB
                                                                                                      • SHA256 34cf19a390fe59e4bba41244c428cef5b6ffd086f2a9191b697a75eab48523fe
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                      • Size 12KB
                                                                                                      • SHA256 69621ccd3b308c2d8e4b7fe559c3bf786e963e7579de4ccd665b5a4b7998741b
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                      • Size 11KB
                                                                                                      • SHA256 814600e0fe3fb78bcdb5d82a0a16ef6ce561acbf697f5428e31576e244472323
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                      • Size 12KB
                                                                                                      • SHA256 9cc5d1da1d5f2a13921f4f3467b7e020b523af932aeebd288c4c7cd71b030691
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                      • Size 12KB
                                                                                                      • SHA256 7b7e57c1f49e4994c8afe8dd224cf111648247cf3a3e1e3f3f911aafd7e1c030
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                      • Size 12KB
                                                                                                      • SHA256 8fa92144851f2b3bb07fc7e044ac36616861350eb3eb15e3495c9aa87d52a7d0
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                      • Size 11KB
                                                                                                      • SHA256 f97834fcf4eee889955793ed48ffea75386c1325a77da6307aea8e47085949ea
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                      • Size 11KB
                                                                                                      • SHA256 4111236e44842894bbc05fc61a31f4a6177fde19e712676a254271a3c1c3d218
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                      • Size 11KB
                                                                                                      • SHA256 0211dd4bde7d05e1cabad0426688da20fa6d952936a8146d2a3d61417c4f88bb
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                      • Size 11KB
                                                                                                      • SHA256 d26c2442207eed34f2a5c81d1ea9c7c395b8a7ffa05d475ba9ac0799427d9259
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                      • Size 12KB
                                                                                                      • SHA256 72d6ae2ed0f0bec0630990cf5d3c3742c850cfb9637176039433e12a2c8e5ebc
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                      • Size 11KB
                                                                                                      • SHA256 657a6ab974c9a7cf9bdc5e4c1be43ef6b4ac972a482b7f31a0a80923d062ae5d
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                      • Size 12KB
                                                                                                      • SHA256 e2345d36dd8e4a6016806e7aa1d8832569ea6a4ab1c95d73a85bd3f45333094d
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                      • Size 12KB
                                                                                                      • SHA256 b312236996f3516f95b5fabed683f99b9d26a0cc310dcb6f8c1eed96fe65f47a
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                      • Size 10KB
                                                                                                      • SHA256 a8fcf0e7159b637c7f41ce0804d52a76a750cea36ac4818549708e51b0063371
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                      • Size 12KB
                                                                                                      • SHA256 c555ca105c0c1d88cd0864820be8e9d5f60c8841993692b5757fc9b80d21da81
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Secure Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                      • Size 15KB
                                                                                                      • SHA256 d0f29f5669dcc1ac323b3919c5c1cfbcf11ab5ab3fe0117274cbb86b7fa45b95
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Secure Preferences
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                      • Size 15KB
                                                                                                      • SHA256 2b6996ff14dd08a7e1fc621dff2e39f124c02403584f7f3238e59f234b8a2b89
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\0c9c5ff0-a63b-487b-89a2-19856cb618cb\index-dir\the-real-index
                                                                                                      • Size 72B
                                                                                                      • SHA256 c8b206e3cb1394c6ce0319d89c672833f35cf633f2490bde5d1920bb5ce9e553
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index~RFe59142a.TMP
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\0c9c5ff0-a63b-487b-89a2-19856cb618cb\index-dir\the-real-index~RFe59142a.TMP
                                                                                                      • Size 48B
                                                                                                      • SHA256 211977ec61e8c76080362bb47f6f896d092c74399f28b06e112c2b858a30bd2b
                                                                                                      • MD5 SHA1 SHA512
                                                                                                      Submit Download

                                                                                                      the-real-index
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\6177adf1-02b8-48e0-9765-476c5fa6f2d8\index-dir\the-real-index
                                                                                                      • Size 72B
                                                                                                      • SHA256 12037c2c1e61c4b9152daba2dd52e1210cbc21c90590ac2c2a99800afbca619f
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index~RFe593c73.TMP
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\6177adf1-02b8-48e0-9765-476c5fa6f2d8\index-dir\the-real-index~RFe593c73.TMP
                                                                                                      • Size 48B
                                                                                                      • SHA256 4f675cc1bb8d7f9b7b37a50738e69cf1ecb5eb76857bce73185b0dcc0fc1769d
                                                                                                      • MD5 SHA1 SHA512
                                                                                                      Submit Download

                                                                                                      index.txt
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                                                      • Size 177B
                                                                                                      • SHA256 14f64308ea796ffdb94fd5742c3f8aa90830d9d330dfa6cbd35713d1eb607a33
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      index.txt
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                                                      • Size 170B
                                                                                                      • SHA256 6875446af5b9ee7ead1d9c6545b82252c6aacc4cefa9545e87b64a7de8fdc580
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      index.txt
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                                                      • Size 173B
                                                                                                      • SHA256 69d843d93a3df7490b784f6d42ebf13f737fc23ebb16ca9d479b0f2f1b48c531
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      index.txt~RFe57f136.TMP
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe57f136.TMP
                                                                                                      • Size 114B
                                                                                                      • SHA256 faaa18345ab91ab3a36b2a3eed89309160e7c91474c3126557497e0ab0057dda
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                      • Size 72B
                                                                                                      • SHA256 5d9f09f5b9d1b3e70dbe78eda48d4d979cb1b544df71c0f04e20c18b41f00584
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                      • Size 72B
                                                                                                      • SHA256 fe83bd25df57d848e5bf9857468fdfd2c4182e53e5bd2dda673f029efc5f5cb4
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      the-real-index~RFe580a8a.TMP
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe580a8a.TMP
                                                                                                      • Size 48B
                                                                                                      • SHA256 30807829e8831032fdd78feb5d3e42e1fa6c35a67bae3c5d7cbc37e08ed42d47
                                                                                                      • MD5 SHA1 SHA512
                                                                                                      Submit Download

                                                                                                      Local State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                      • Size 206KB
                                                                                                      • SHA256 ac71208f0dfdede1189f49ecd0e137e48cff9bbb162c43173e8992a64d4a4d85
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Local State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                      • Size 82KB
                                                                                                      • SHA256 d975d809c27c9ea7d84311d6c600bd8acc6fc427655ca6ecf91d5b5e77b5f391
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Local State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                      • Size 205KB
                                                                                                      • SHA256 93073830a0bbe78ae3e8a828ff21756f264acf1375045b390803f666b3963aaa
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Local State
                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                      • Size 205KB
                                                                                                      • SHA256 80863ae4a18080480c5287fca6c92e127cd74e7d3a23f467b696f92e1addb25e
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      f8451123-e094-4f48-85ea-6b95155c567b.down_data
                                                                                                      • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\f8451123-e094-4f48-85ea-6b95155c567b.down_data
                                                                                                      • Size 555KB
                                                                                                      • SHA256 855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      10461fdfb35f35cca13dbe35dcf21343
                                                                                                      • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\10461fdfb35f35cca13dbe35dcf21343
                                                                                                      • Size 3.5MB
                                                                                                      • SHA256 73c9d9a9333623a070ccc1e5f6cf325d83f1ef9ce35c4d255b66a1733f6e6a91
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      1d0390337d1a4a58e5514be1a9481ad6
                                                                                                      • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\1d0390337d1a4a58e5514be1a9481ad6
                                                                                                      • Size 2.3MB
                                                                                                      • SHA256 c79f0eeb2bca4905c585c50333db3c6f727a554f5db82e64948f93668fbc18aa
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      1feb81a960ffd6b6b3d0b2ffc7d14882
                                                                                                      • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\1feb81a960ffd6b6b3d0b2ffc7d14882
                                                                                                      • Size 13.5MB
                                                                                                      • SHA256 532df9ebd728e73c8a43a14a042acbbdf80614bc0a6e7526e0f78a381635cafa
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      5fd542bbdb9f19f8f0a66c0086de58e0
                                                                                                      • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\5fd542bbdb9f19f8f0a66c0086de58e0
                                                                                                      • Size 127KB
                                                                                                      • SHA256 0f02766f26e34b32d3169724847a8ac7916eee683e6ca0ef3fc9505f678b27dc
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      723f117eb401f87b7f0f0a147f0471a6
                                                                                                      • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\723f117eb401f87b7f0f0a147f0471a6
                                                                                                      • Size 20.2MB
                                                                                                      • SHA256 29aa97911e1cd1a0a121c87965b16eca8fbd629eaa8393688c163f5319f1d452
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      8b94667332d30a7f0ce55a09dfb99023
                                                                                                      • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\8b94667332d30a7f0ce55a09dfb99023
                                                                                                      • Size 9.7MB
                                                                                                      • SHA256 2c2d56486960edf4acfff3d9d72037cad750a0afaf406d263a5c5f1f9e3f1b43
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      8f379ec2b22ff106b837d79f7fdbf0d8
                                                                                                      • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\8f379ec2b22ff106b837d79f7fdbf0d8
                                                                                                      • Size 13.1MB
                                                                                                      • SHA256 6620658a6288e6b58b8d86aaef4e7734e10778974e9a01d364fc7aac4d35f10b
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      97327884177381d0f42d428110b4c516
                                                                                                      • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\97327884177381d0f42d428110b4c516
                                                                                                      • Size 3KB
                                                                                                      • SHA256 b8d4802f5c25d188268bf6a3a1c72a00d56a7b3f7fe64bb7f5fc4d6e8f6b8a28
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      a002b19246460d468ac2b64be269557a
                                                                                                      • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\a002b19246460d468ac2b64be269557a
                                                                                                      • Size 596KB
                                                                                                      • SHA256 5038bf9d7a31156aca0d4d502b6ec282153fa42190163f90de61c92d2cc78bad
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      a0de69e18bdbe353cec000b89b293685
                                                                                                      • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\a0de69e18bdbe353cec000b89b293685
                                                                                                      • Size 81KB
                                                                                                      • SHA256 edc0bdd3baee8f10ac2fc76581a098f04ee9160096bcbccc431884175c807da2
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      a8189ddacb4f596fbbbb9a011d7f97fe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\a8189ddacb4f596fbbbb9a011d7f97fe
                                                                                                      • Size 273KB
                                                                                                      • SHA256 dee41d7a4bf1b7b195e8c6766d0e3fb152898ba440cd627e48d0c9f3afc0dafb
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      a919e96d3276950f67903c0c19164e8a
                                                                                                      • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\a919e96d3276950f67903c0c19164e8a
                                                                                                      • Size 295KB
                                                                                                      • SHA256 bd6af97e1844009feefd8f5cdb8b24ed9f961e0b4f83b075a6dee80214fda32a
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      aac2b417eabea6376883ac2f50ff9c61
                                                                                                      • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\aac2b417eabea6376883ac2f50ff9c61
                                                                                                      • Size 775KB
                                                                                                      • SHA256 5aa57113db54296bee8f723c1a2a1d5cab5481c8064fb31e957743ecc8c20247
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      aefc4c4a576dbb9e3acb1d8eb2d95106
                                                                                                      • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\aefc4c4a576dbb9e3acb1d8eb2d95106
                                                                                                      • Size 4.9MB
                                                                                                      • SHA256 83db6db9d2b36271433309b981f85fc3184505ec38900cd1a83ccac36b68690c
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      c9337cd8b2ac38fc3c0d4df61a357ce0
                                                                                                      • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\c9337cd8b2ac38fc3c0d4df61a357ce0
                                                                                                      • Size 5.7MB
                                                                                                      • SHA256 1fdcfb4be1954900413226e59344bd316c509c8e81cb71af2c32bf019520a051
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      cf84ed25b561c6bad26aadd68a343adf
                                                                                                      • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\cf84ed25b561c6bad26aadd68a343adf
                                                                                                      • Size 3.0MB
                                                                                                      • SHA256 9f6738afdbac1136aab4cc0522bdbbbcb4f64f937c5bbadc82e7c51f8185eb9b
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      eb61feeae2160215cd0323223fac1ed5
                                                                                                      • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\eb61feeae2160215cd0323223fac1ed5
                                                                                                      • Size 6.3MB
                                                                                                      • SHA256 85ed66e674510aa960b35d46d7b81a06b63cb14303b495dd3641807bb23db3d3
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      eb9dd4d0637fd6ae21747e6b6a281d21
                                                                                                      • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\eb9dd4d0637fd6ae21747e6b6a281d21
                                                                                                      • Size 459KB
                                                                                                      • SHA256 5a3aae5657899b6452004f3f43f122cb6c166c99b7261efbeb965da906626ed8
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      f582d22be825372ec1a099455e757de6
                                                                                                      • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\f582d22be825372ec1a099455e757de6
                                                                                                      • Size 362KB
                                                                                                      • SHA256 acade1ab00c36d423e754c1bf7f0fae3294e9c146f2591cdc787fa52116135c3
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      fbb0ce7a795cad22ef0c116ae89f13d4
                                                                                                      • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\fbb0ce7a795cad22ef0c116ae89f13d4
                                                                                                      • Size 433KB
                                                                                                      • SHA256 7041752f10d5275ef1021afa12523aa9f5e534c0a2ff87d6921c1f70cc68b534
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      cacert.pem
                                                                                                      • Path C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem
                                                                                                      • Size 223KB
                                                                                                      • SHA256 2eba303a7b3c87f0c52fa8f977b703ec6dea7de703f97644546d2d34e53e4cd9
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      ValkzWare.pdb
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Rar$EXa1220.40715.rartemp\Release\ValkzWare.pdb
                                                                                                      • Size 7.1MB
                                                                                                      • SHA256 3e9eb03d4432e912633265745f8082c1dbce26df150c32238c508540c1d4d838
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      basebutyeaaa.pdb
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Rar$EXa1220.40715.rartemp\Release\basebutyeaaa.pdb
                                                                                                      • Size 7.1MB
                                                                                                      • SHA256 9f9f0ecb893327b70c9246ae40911cfe175900ead7f11be6faf734f602ca3b10
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      .json
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Rar$EXa1220.40715.rartemp\Release\configs\.json
                                                                                                      • Size 2KB
                                                                                                      • SHA256 623cd3ebaa23fae17d9aabe8a37f337863dffbfa9070b4ff4b6ddc53c1c03780
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      autoload.json
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Rar$EXa1220.40715.rartemp\Release\configs\autoload.json
                                                                                                      • Size 31B
                                                                                                      • SHA256 46f8b8ccb3bad609e3642c6aeecd8774893f661d0e0c1c1be126877656d75e69
                                                                                                      • MD5 SHA1 SHA512
                                                                                                      Submit Download

                                                                                                      dd.json
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Rar$EXa1220.40715.rartemp\Release\configs\dd.json
                                                                                                      • Size 2KB
                                                                                                      • SHA256 bec8a7710182445a95a10ecdd1299a8361932dc08e454e3e913f2ae47379ce99
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      fa-brands-400.ttf
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Rar$EXa1220.40715.rartemp\Release\fonts\fa-brands-400.ttf
                                                                                                      • Size 205KB
                                                                                                      • SHA256 0821aa9ca9cc259fad64b1dc7f1cc5be71faaee46bb945ede763fca0c4166bed
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      fa-regular-400.ttf
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Rar$EXa1220.40715.rartemp\Release\fonts\fa-regular-400.ttf
                                                                                                      • Size 66KB
                                                                                                      • SHA256 557e6966ad8dba7352ac6d350c1546b685b13d68db26f09cba45cadd660d45db
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      fa-solid-900.ttf
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Rar$EXa1220.40715.rartemp\Release\fonts\fa-solid-900.ttf
                                                                                                      • Size 416KB
                                                                                                      • SHA256 af19d135d3a935b3ebfbd80320716ffe1202052c5f68dc2c5f1abc57005ac605
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      imgui.ini
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Rar$EXa1220.40715.rartemp\Release\imgui.ini
                                                                                                      • Size 53B
                                                                                                      • SHA256 1e21059a351147e54cfdaca82ed646444088932581ca4b6fac73152495367f13
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      basebutyeaaa.exe
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Rar$EXa2276.27792.rartemp\Release\basebutyeaaa.exe
                                                                                                      • Size 731KB
                                                                                                      • SHA256 082b02c2de9a75c0adfbd3bdb157fcbd82e46c6cb26d1c37f474ccfe750ef4ad
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      8913724486d5e3c463c493b25346ca31
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\8913724486d5e3c463c493b25346ca31
                                                                                                      • Size 64B
                                                                                                      • SHA256 d6cd785ba81d603e68394cd0141821074fba567330414136e25ebc3ee932dd99
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      8b2048e6-6f65-43ef-bbf9-c3b8c8cb1c6a.tmp
                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3896_404082594\8b2048e6-6f65-43ef-bbf9-c3b8c8cb1c6a.tmp
                                                                                                      • Size 147KB
                                                                                                      • SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      default.dic
                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                      • Size 2B
                                                                                                      • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                      • MD5 SHA1 SHA512
                                                                                                      Submit Download

                                                                                                      AlternateServices.bin
                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o6jq9lhw.default-release\AlternateServices.bin
                                                                                                      • Size 6KB
                                                                                                      • SHA256 c6d21a7c0d96aaaaf88b49de8d318b6467ec2f932effecd038e195225b75ec9f
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      data.safe.tmp
                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o6jq9lhw.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                      • Size 28KB
                                                                                                      • SHA256 3eb964e49ac3442e46146abc5c1c97aa2aa3dab41d1bf537aed561d1b868cc84
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      data.safe.tmp
                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o6jq9lhw.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                      • Size 6KB
                                                                                                      • SHA256 a404e50b03e380734e3c53fa00427a39dce3071378c2ef8d52d17e2b0a73088b
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      events
                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o6jq9lhw.default-release\datareporting\glean\events\events
                                                                                                      • Size 1KB
                                                                                                      • SHA256 fc34d338b577ae1786c11a6f5199a7c1f11281ceb9cc0668b70d6ea89b71f3a3
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      02dc188e-0174-45ce-a7e4-87a56b6c9367
                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o6jq9lhw.default-release\datareporting\glean\pending_pings\02dc188e-0174-45ce-a7e4-87a56b6c9367
                                                                                                      • Size 235B
                                                                                                      • SHA256 df374f460512f77e95d584f731427ebb52e03d926f9d4b3deaee7991cc529d35
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      2d2cfbab-a573-4a75-ae0e-d173cd3eaaae
                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o6jq9lhw.default-release\datareporting\glean\pending_pings\2d2cfbab-a573-4a75-ae0e-d173cd3eaaae
                                                                                                      • Size 2KB
                                                                                                      • SHA256 4fc903baf9c15adaf1a2130ce0d1d1a19a95787cc6633f459f99d1cb2e0502d8
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      83695c03-091f-4edc-a517-c5bc65623fc2
                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o6jq9lhw.default-release\datareporting\glean\pending_pings\83695c03-091f-4edc-a517-c5bc65623fc2
                                                                                                      • Size 235B
                                                                                                      • SHA256 f9eea8d37c782350dfb0262e5f634e66befacfe022bcaf085fd11a5a35a03beb
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      918a6107-73b5-4201-aea7-ba70e258087e
                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o6jq9lhw.default-release\datareporting\glean\pending_pings\918a6107-73b5-4201-aea7-ba70e258087e
                                                                                                      • Size 883B
                                                                                                      • SHA256 25f901e3eb063b14285f34b777abd96d7b15e471122a9cadd34efae17b8a0e72
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      985b2578-92be-4c39-9346-986c0dee9510
                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o6jq9lhw.default-release\datareporting\glean\pending_pings\985b2578-92be-4c39-9346-986c0dee9510
                                                                                                      • Size 16KB
                                                                                                      • SHA256 4ddd8993e4a1c07521dea996e2048feec71701cb9c8bb61d4f03042449685cf1
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      fd2da885-e1f9-4db3-9706-0b986c43cb99
                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o6jq9lhw.default-release\datareporting\glean\pending_pings\fd2da885-e1f9-4db3-9706-0b986c43cb99
                                                                                                      • Size 886B
                                                                                                      • SHA256 c61125635ae2b25bb3cd9beb750326c70708a47eee4b587a72f173fc72d8da39
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      prefs-1.js
                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o6jq9lhw.default-release\prefs-1.js
                                                                                                      • Size 6KB
                                                                                                      • SHA256 9023e9920f10542293e79b568e0a50c6eacbc13d6d65368fb438baebe3b79c17
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      prefs.js
                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o6jq9lhw.default-release\prefs.js
                                                                                                      • Size 6KB
                                                                                                      • SHA256 955b2c4cce40964692487e4038fa08dd508d99b68fe0bd5288c8bca91c4bf5c4
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      prefs.js
                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o6jq9lhw.default-release\prefs.js
                                                                                                      • Size 6KB
                                                                                                      • SHA256 e7e0d369cf8bdf308d3d8dfb3e0ff9e273e666f63bd0ce102b3ea9f0b5151e9d
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      Release.rar:Zone.Identifier
                                                                                                      • Path C:\Users\Admin\Downloads\Release.rar:Zone.Identifier
                                                                                                      • Size 26B
                                                                                                      • SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
                                                                                                      • MD5 SHA1 SHA512
                                                                                                      Submit Download

                                                                                                      Release.rar
                                                                                                      • Path C:\Users\Admin\Downloads\Release\Release.rar
                                                                                                      • Size 3.3MB
                                                                                                      • SHA256 72dae87791858abc2523e916a43958e7411eb30029e86250baa0b09208c75df3
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      memory/1112-3876-0x00000165F4550000-0x00000165F455C000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1112-3875-0x00000165F0420000-0x00000165F0540000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1252-4126-0x0000022C4BBE0000-0x0000022C4BBEC000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1252-4125-0x0000022C4BAC0000-0x0000022C4BBE0000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1420-3942-0x0000021DDA790000-0x0000021DDA8B0000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1420-3983-0x0000021DDA790000-0x0000021DDA8B0000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1420-4021-0x0000021DDA790000-0x0000021DDA8B0000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1420-3944-0x0000021DDC120000-0x0000021DDC12C000-memory.dmp
                                                                                                      Download

                                                                                                      memory/1420-3943-0x0000021DDC100000-0x0000021DDC112000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2084-52-0x0000000001590000-0x00000000015B5000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2084-1622-0x0000000001590000-0x00000000015B5000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2084-1130-0x0000000001590000-0x00000000015B5000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2096-3748-0x00000218890C0000-0x00000218890CC000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2096-3747-0x0000021888FA0000-0x00000218890C0000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2276-3932-0x00000224E0370000-0x00000224E0490000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2276-4168-0x00000224E0370000-0x00000224E0490000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2276-4019-0x00000224E0370000-0x00000224E0490000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2276-3910-0x00000224E47B0000-0x00000224E47BC000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2276-3909-0x00000224E0370000-0x00000224E0490000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2276-4005-0x00000224E0370000-0x00000224E0490000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2276-3996-0x00000224E0370000-0x00000224E0490000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2276-3963-0x00000224E0370000-0x00000224E0490000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2960-3864-0x0000019EFCC40000-0x0000019EFCD60000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2960-3866-0x0000019EFEAE0000-0x0000019EFEAF2000-memory.dmp
                                                                                                      Download

                                                                                                      memory/2960-3865-0x0000019EFEAD0000-0x0000019EFEADC000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3240-3980-0x000001930EC70000-0x000001930ED90000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3240-3874-0x000001930EC70000-0x000001930ED90000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3240-3908-0x000001930EC70000-0x000001930ED90000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3240-3995-0x000001930EC70000-0x000001930ED90000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3240-4096-0x000001930EC70000-0x000001930ED90000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3240-3931-0x000001930EC70000-0x000001930ED90000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3332-2184-0x00000133BEA10000-0x00000133BEA6D000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3440-490-0x00000141EAA10000-0x00000141EAA6D000-memory.dmp
                                                                                                      Download

                                                                                                      memory/3772-2183-0x00000125E8680000-0x00000125E86DD000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4204-3927-0x000001BAD14F0000-0x000001BAD1610000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4204-3928-0x000001BACFAB0000-0x000001BACFABC000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4280-3843-0x0000016FBBEA0000-0x0000016FBBFC0000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4280-3845-0x0000016FBD930000-0x0000016FBD942000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4280-3844-0x0000016FBD920000-0x0000016FBD92C000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4704-537-0x0000018360A60000-0x0000018360B80000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4704-538-0x0000018360880000-0x000001836088C000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4952-4103-0x0000026CB8550000-0x0000026CB855C000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4952-4102-0x0000026CB9E30000-0x0000026CB9F50000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4996-4094-0x000001FD1A4A0000-0x000001FD1A5C0000-memory.dmp
                                                                                                      Download

                                                                                                      memory/4996-4095-0x000001FD1A5D0000-0x000001FD1A5DC000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5420-4002-0x0000000001890000-0x00000000018B5000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5420-3978-0x0000000001890000-0x00000000018B5000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5856-3825-0x000002075F7B0000-0x000002075F80D000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5936-3859-0x000001B2DCAC0000-0x000001B2DCAD2000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5936-3858-0x000001B2DC3A0000-0x000001B2DC3AC000-memory.dmp
                                                                                                      Download

                                                                                                      memory/5936-3857-0x000001B2DAAA0000-0x000001B2DABC0000-memory.dmp
                                                                                                      Download

                                                                                                      memory/6296-4085-0x0000000001B90000-0x0000000001BB5000-memory.dmp
                                                                                                      Download

                                                                                                      memory/6296-4065-0x0000000001B90000-0x0000000001BB5000-memory.dmp
                                                                                                      Download

                                                                                                      memory/6336-4049-0x000001F2994B0000-0x000001F2995D0000-memory.dmp
                                                                                                      Download

                                                                                                      memory/6336-4050-0x000001F297BC0000-0x000001F297BCC000-memory.dmp
                                                                                                      Download

                                                                                                      memory/6764-3749-0x00000000016F0000-0x0000000001715000-memory.dmp
                                                                                                      Download

                                                                                                      memory/6764-3826-0x00000000016F0000-0x0000000001715000-memory.dmp
                                                                                                      Download

                                                                                                      memory/7132-3965-0x000002285B4D0000-0x000002285B5F0000-memory.dmp
                                                                                                      Download

                                                                                                      memory/7132-3966-0x000002285B3B0000-0x000002285B3BC000-memory.dmp
                                                                                                      Download

                                                                                                      memory/7148-3930-0x000001504EBD0000-0x000001504EBDC000-memory.dmp
                                                                                                      Download

                                                                                                      memory/7148-3929-0x0000015050750000-0x0000015050870000-memory.dmp
                                                                                                      Download

                                                                                                      memory/7444-3842-0x000001D0C12D0000-0x000001D0C13F0000-memory.dmp
                                                                                                      Download

                                                                                                      memory/7576-3651-0x000001BEA9070000-0x000001BEA9190000-memory.dmp
                                                                                                      Download

                                                                                                      memory/7576-3652-0x000001BEA7530000-0x000001BEA753C000-memory.dmp
                                                                                                      Download