c4c0b8e1593bc5481521cecfce00b953e3ee6d7323b98e7ddf2e8c90a78ce545

Analysis

user interaction
yes
max time kernel
264s
max time network
266s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VelocityLite.exe
Size 232KB
Sample260710-ty5wmsft3z
SHA256 c4c0b8e1593bc5481521cecfce00b953e3ee6d7323b98e7ddf2e8c90a78ce545
MD5 e4df8ee6e755c3da3088701eb1c05b76
SHA1 c52dbc1190b84555e27649b9b54746b958e5f3cb
SHA512 623ae06db60f42e33c6e94b4d74a20d6e456a1edb94e2b8bc58424532f27bc5baa516465cad455bddc0351e21614d4965919a123b7cb0891b8527021928a09d5
SSDEEP 3072:IlDJk88wN1QI7sxrYL1peQ3lOY9SkHNwG7NzaAT56Q7BQz:UAIwxrI14Q3kYBTM5QNQ
TLSH
T185341903B65890BAE1A2D638CD928981E7727C594F71A6CF37507B7E0F766D09E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
44	3460	chrome.exe

Executes dropped EXE 12 IoCs

pid	Process
3336	RobloxPlayerInstaller.exe
5892	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe
1760	RobloxPlayerBeta.exe
3120	RobloxPlayerBeta.exe
2012	RobloxPlayerBeta.exe
4672	RobloxPlayerBeta.exe
4940	RobloxPlayerBeta.exe
4320	RobloxPlayerBeta.exe
1724	RobloxPlayerInstaller.exe
4892	RobloxPlayerBeta.exe
3832	RobloxPlayerBeta.exe

Loads dropped DLL 5 IoCs

pid	Process
2168	RobloxPlayerBeta.exe
3120	RobloxPlayerBeta.exe
4672	RobloxPlayerBeta.exe
4320	RobloxPlayerBeta.exe
3832	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs

pid	Process
2168	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe
2168	RobloxPlayerBeta.exe
3120	RobloxPlayerBeta.exe
3120	RobloxPlayerBeta.exe
3120	RobloxPlayerBeta.exe
4672	RobloxPlayerBeta.exe
4672	RobloxPlayerBeta.exe
4672	RobloxPlayerBeta.exe
4320	RobloxPlayerBeta.exe
4320	RobloxPlayerBeta.exe
4320	RobloxPlayerBeta.exe
3832	RobloxPlayerBeta.exe
3832	RobloxPlayerBeta.exe
3832	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\avatar\abilities\AbilityManagerActor_oldClientInitialize.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Input\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Settings\Players\FriendIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\InGameMenu\game_tiles_background_desktop.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\PlatformContent\pc\textures\water\normal_13.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\DevConsole\Search.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\VoiceChat\Unmuted40.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\VoiceChat\MicDark\Unmuted20.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\ExternalSite\guilded.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\configs\DateTimeLocaleConfigs\zh-cjv.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Settings\MenuBarAssets\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\avatar\animations\humanoidR15AnimateChildren.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\SelfView\SelfView_icon_close.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\SelfView\SelfView_icon_indicator_on.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\graphic\Auth\GridBackground_05202026.jpg	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaChatV2\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\PlatformContent\pc\textures\sky\sky512_lf.tex	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\ErrorPrompt\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaChat\9-slice\chat-bubble-self-tip.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\avatar\scripts\R15MoodsV2.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\collapsibleArrowRight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\DefaultController\Thumbstick1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Emotes\Editor\TenFoot\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\AvatarExperience\CircleCutoutLargeNoBorder.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\graphic\gr-avatar [email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\sounds\action_jump_land.mp3	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\fonts\Fondamento-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\fonts\families\Zekton.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\scrollbuttonDown_ovr.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\scrollbuttonUp_dn.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Keyboard\close_button_background.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\StudioSharedUI\preview_expand.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Settings\Help\BButtonDark.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\ExternalSite\roblox.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\graphic\profilemask_36.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\graphic\Auth\classind_16.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\AvatarImporter\img_dark_R15.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\PlayerList\Clear.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaChat\icons\ic-close-white.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\option.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\xboxLSDirectional.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\graphic\GameDetailsBackground\abkg_general.jpg	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3460	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX-PLAYER	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281746320149174"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-36a2600cebf1487d\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-4bb3958a2cde4efb"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-36a2600cebf1487d\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-36a2600cebf1487d\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-36a2600cebf1487d\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX\DEFAULTICON	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-36a2600cebf1487d"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-36a2600cebf1487d\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-36a2600cebf1487d"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-36a2600cebf1487d\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-36a2600cebf1487d\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-36a2600cebf1487d\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX-PLAYER\SHELL\OPEN\COMMAND	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-36a2600cebf1487d"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-36a2600cebf1487d"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX\SHELL\OPEN\COMMAND	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX-PLAYER\DEFAULTICON	RobloxPlayerInstaller.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2548	chrome.exe
2548	chrome.exe
3336	RobloxPlayerInstaller.exe
3336	RobloxPlayerInstaller.exe
2168	RobloxPlayerBeta.exe
2548	chrome.exe
2548	chrome.exe
3120	RobloxPlayerBeta.exe
5012	chrome.exe
5012	chrome.exe
4672	RobloxPlayerBeta.exe
4320	RobloxPlayerBeta.exe
1724	RobloxPlayerInstaller.exe
1724	RobloxPlayerInstaller.exe
3832	RobloxPlayerBeta.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

pid	Process
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe
2548	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 6012	2548	chrome.exe	90
PID 2548 wrote to memory of 3460	2548	chrome.exe	91
PID 2548 wrote to memory of 5596	2548	chrome.exe	92
PID 2548 wrote to memory of 5596	2548	chrome.exe	92
PID 2548 wrote to memory of 2784	2548	chrome.exe	94
PID 2548 wrote to memory of 2784	2548	chrome.exe	94
PID 2548 wrote to memory of 4556	2548	chrome.exe	95
PID 2548 wrote to memory of 5640	2548	chrome.exe	96
PID 2548 wrote to memory of 4556	2548	chrome.exe	95
PID 2548 wrote to memory of 5640	2548	chrome.exe	96
PID 2548 wrote to memory of 1496	2548	chrome.exe	97
PID 2548 wrote to memory of 1496	2548	chrome.exe	97
PID 2548 wrote to memory of 2660	2548	chrome.exe	98
PID 2548 wrote to memory of 2660	2548	chrome.exe	98
PID 2548 wrote to memory of 4964	2548	chrome.exe	99
PID 2548 wrote to memory of 4964	2548	chrome.exe	99
PID 2548 wrote to memory of 2452	2548	chrome.exe	100
PID 2548 wrote to memory of 2452	2548	chrome.exe	100
PID 2548 wrote to memory of 5904	2548	chrome.exe	101
PID 2548 wrote to memory of 2084	2548	chrome.exe	102
PID 2548 wrote to memory of 2084	2548	chrome.exe	102
PID 2548 wrote to memory of 3480	2548	chrome.exe	103
PID 2548 wrote to memory of 3480	2548	chrome.exe	103
PID 2548 wrote to memory of 1980	2548	chrome.exe	107
PID 2548 wrote to memory of 1980	2548	chrome.exe	107
PID 2548 wrote to memory of 5088	2548	chrome.exe	108
PID 2548 wrote to memory of 5088	2548	chrome.exe	108
PID 2548 wrote to memory of 1656	2548	chrome.exe	109
PID 2548 wrote to memory of 1656	2548	chrome.exe	109
PID 2548 wrote to memory of 1276	2548	chrome.exe	120
PID 2548 wrote to memory of 6040	2548	chrome.exe	111
PID 2548 wrote to memory of 6040	2548	chrome.exe	111
PID 2548 wrote to memory of 1404	2548	chrome.exe	112
PID 2548 wrote to memory of 1276	2548	chrome.exe	120
PID 2548 wrote to memory of 1404	2548	chrome.exe	112
PID 2548 wrote to memory of 3448	2548	chrome.exe	114
PID 2548 wrote to memory of 5632	2548	chrome.exe	113
PID 2548 wrote to memory of 3448	2548	chrome.exe	114
PID 2548 wrote to memory of 2076	2548	chrome.exe	115
PID 2548 wrote to memory of 5632	2548	chrome.exe	113
PID 2548 wrote to memory of 2076	2548	chrome.exe	115
PID 2548 wrote to memory of 4620	2548	chrome.exe	117
PID 2548 wrote to memory of 4620	2548	chrome.exe	117
PID 2548 wrote to memory of 3332	2548	chrome.exe	116
PID 2548 wrote to memory of 3332	2548	chrome.exe	116
PID 2548 wrote to memory of 2096	2548	chrome.exe	118
PID 2548 wrote to memory of 2096	2548	chrome.exe	118
PID 2548 wrote to memory of 4288	2548	chrome.exe	119
PID 2548 wrote to memory of 4288	2548	chrome.exe	119
PID 2548 wrote to memory of 1276	2548	chrome.exe	120
PID 2548 wrote to memory of 2000	2548	chrome.exe	124
PID 2548 wrote to memory of 1872	2548	chrome.exe	125
PID 2548 wrote to memory of 4120	2548	chrome.exe	126
PID 3336 wrote to memory of 2168	3336	RobloxPlayerInstaller.exe	129
PID 2548 wrote to memory of 5128	2548	chrome.exe	137
PID 2548 wrote to memory of 5128	2548	chrome.exe	137
PID 2548 wrote to memory of 3588	2548	chrome.exe	138
PID 2548 wrote to memory of 3588	2548	chrome.exe	138
PID 2548 wrote to memory of 4268	2548	chrome.exe	139
PID 2548 wrote to memory of 4268	2548	chrome.exe	139
PID 2548 wrote to memory of 4600	2548	chrome.exe	140
PID 2548 wrote to memory of 4600	2548	chrome.exe	140
PID 2548 wrote to memory of 2380	2548	chrome.exe	141
PID 2548 wrote to memory of 2380	2548	chrome.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VelocityLite.exe
"C:\Users\Admin\AppData\Local\Temp\VelocityLite.exe"
1⤵
PID:4744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa0,0x134,0x7ff9e2b7c728,0x7ff9e2b7c734,0x7ff9e2b7c740
  2⤵
  PID:6012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1544,i,11252983218244733664,16060694957135911151,524288 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1728,i,18343824355053609083,9112947624632696794,262144 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:5596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,6164755321019245795,3084162091313157985,524288 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:13
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,17872931297370477926,18198952727868157644,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,10539571790539045216,3081862640106673919,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4736,i,9108181824363208097,10218150208596470295,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4900,i,561279893434928172,17202396513792419342,524288 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4952,i,9219253764326403769,8285948073595047709,524288 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5032,i,3014996190192653688,15241343864949267306,524288 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,17427090403876623654,8260122229140217967,524288 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5496,i,8070011532242055647,8094806358733857961,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5536,i,9123925071364879056,753954245463278854,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5412,i,5864169311112335218,10016901592613344901,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,7114254562010069087,10822000785043065816,524288 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5800,i,12841220801581087218,7631288734005341397,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6216,i,7657873340538283792,5975608696597640696,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,18036059280373350809,13195288687627187005,524288 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:6040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6108,i,8560512805430597156,15382810477680978978,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6216,i,6546386013656467503,3164453103023170178,524288 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:5632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6092,i,8482819064617302945,2558569157706288439,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5692,i,12866730009790500903,13988540547894461537,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5844,i,10277344057169843687,9595973551483696260,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5504,i,10414910142639513504,7285381536879277389,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5668,i,10478427825752478234,8352219509204845184,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:9
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6148,i,7438684987290965142,8600265528338685976,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6492,i,9778672280481082991,11259905071171343616,524288 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:14
  2⤵
  PID:1276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,2698874074542924313,7434355764040233840,524288 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
  2⤵
  PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,5631341638254078066,6707500608526122567,524288 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14
  2⤵
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,15181356599890381766,14474278519700115519,524288 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=3636,i,15015178195497133899,9578928672306606517,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6168,i,9711370590620387649,17784782963221110986,524288 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6060,i,7857010211931004326,4445667090127100224,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6588,i,16150626936064683479,7488176519867081733,524288 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6100,i,15728746649022345899,4483546740816191023,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6308,i,765404323230453169,9096726134720022697,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6804,i,7416347856406339845,3947150417204951571,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6756,i,14004217963987977378,15325077408641776849,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=5552,i,17517597665818086382,6950770063198226091,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=6716,i,16857733432403034603,16819327861870687609,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=6804,i,12539868866652862469,9364849247652792471,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5712,i,4343056901600133634,5983886446871546628,262144 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=4752,i,8096368281082538557,8271790860453134982,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=7052,i,11865231814246420486,1473789171394694383,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=6148,i,9883596868466087117,3437453337696427848,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=4760,i,3817372383318004670,15663285679002474076,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=1204,i,13409811064360951788,10694178346952572893,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=4724,i,12891731452681653110,5929893671203361118,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=7256,i,15787884306837057081,8805251564014723543,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=7436,i,6720614921788442216,2947723699353516322,2097152 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7568,i,15065895258063920692,1349298003706866061,524288 --field-trial-handle=2020,i,17770482284493043461,3151034324823501112,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:14
  2⤵
  PID:1056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3580

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4916

C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 3336
  2⤵
  - Executes dropped EXE
  PID:5892
- C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 3336
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2168

C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:1760

C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3120

C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:2012

C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4672

C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:4940

C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4320

C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerInstaller.exe
"C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerInstaller.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1724
- C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 1724
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 1724
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:3832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.6MB
SHA256 605c024da43bb554542bd91d4d8688db6cc3b725f020e07b67c709de01a2a9c4
MD5 861dd6fa62771d9c50fa74cb94237d1a
SHA1 a1218ed98527ba4d252f01f25c3ea7238944ebd0
SHA512 4d600b8c1a3b89298cacba8549dea286e3962e44496ca9404a30ab7ef400620d780e9acacbe50f6b218726bdfddecbec0e1b16b243deea097e604a9e3d6b19db
SSDEEP 196608:sytUeAe3XKrW86kmLD0msx1WoZivT6WibBrKCZ:s0XK00msx1bZIT6Wi1nZ
TLSH
T138A6AE22B901C032E8D200B296BD5FFA993D9E341B3954D3A7D45DB95A305D33B39B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.dll
Size 20.7MB
SHA256 650840a8a47d32f6b58d0c8d2b53cd82c07f6153067ea81fca425995b82d56a3
MD5 6880846bde28e2d05a247fa2a2187224
SHA1 8e69b4f935cf78af99d63a10dc7b44dfcb179d2e
SHA512 66fd7997ca331a43ab40102b3fa02cec3269fdc503418cbd1b2476c8e87dde5654e075963cfa26540455a655f6ac6483c3696ab59535c6ea71b8e705757b8eed
SSDEEP 196608:Q3Nw591wKdbnHLuOixYG+YfHLfNqnKUc:gNI9P1inXfc
TLSH
T19327BF4EB8D20AE8D2725070E05F57E3EA62708C0B6D2EF746E94111363369E564AF7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000035

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000035
Size 373KB
SHA256 a5c27d3298042314d98634f85836ab0c48cbdf572ee676981a852c3e18738d8e
MD5 7eb1501498252ec1a30118a2d3917c94
SHA1 b275a098ab3e050e2b4ac71eac10c238c2365c45
SHA512 8f5831b6bfeaea74aba0d23b684687e0a308f51f1528859535c9df335367b946b6be42500ce637e77baff40795bbf152e24abcfcee227c6d9d0e490412e09d26
SSDEEP 6144:bBJYkBiu4su2hIklCVm8ZiLHBd0R+2jBLX47rD+CNOgtU28xNAoWclJ/lo31jjuQ:bfWV22kvnBSw2FLIPDVNfN8nWclJ/Md9
TLSH
T100842306FA0DD6F4A7A40DDD2990A3E04D1372444CFC4A347B8523B9DDE3AEF4A159AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003c
Size 21KB
SHA256 f27a6476b305b02df8a847aaef823b24781a3554f64d77ecf67b68d69092a013
MD5 20a6461d829e5dadef107f9077c952b4
SHA1 7656eaa4a104b9b19b1f3d5925e457687d350905
SHA512 6463734a05aa5f19a94d3650025da20e88ef04d64541a7980e8915ccb79727ec04d99c14f2709c7eb0537b8eb025053650dc7b9a0c954f8a141c6d07a844f005
SSDEEP 384:I9oPSZpeRAto0IVm4Y+ziPMguUd0HfNGAUY5Ty9QJOfg11T3uVuQ1cVLHIRS2a0G:hIeRXZm4Y+OEguUdMGAXW9Y113uYQ1+5
TLSH
T104A2E086779268AFCF7B63B38444B2B8F09B9F0F60863F4A445514876CEB5FE8048E00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000045

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000045
Size 158KB
SHA256 60072b4eb6fc5f1f1214a34fcd55b3cbd1d05eddf778f85611f9b352c4c6452d
MD5 83266658f29f5cb762001d5d9f6985a7
SHA1 9ff52157193e1e798944e6a3172d938183f5e550
SHA512 60b2a8749bb597b71c6cb7113c4ea6c430ab90c6f6a5f78a36ab5fbd2676fbc173ade236be939e862569c786fbdc8e0aa984f1ae4263e91de2ba681cc8ce5d66
SSDEEP 3072:pqj6fcYjfI87fn/NWUEu+Y4rwgnWSPrrGh9SC2VRvkQdv45cf+Fg:pTvjg87fnVTEu+W3rSC2VRpBf+y
TLSH
T196F3232CABB1EF2298ADD32D789EF491C870553AC097303BB84FDF8575154348A7684E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 eabaa1ef6a01f3fe729bcbe6968895cb6182bbd1b039b3abd607c5c4dee07383
MD5 dd3ea4a4d81a19992d5f1fc29a5a6c1e
SHA1 e401a4543c98447458ef702b7fbb04cef3681cff
SHA512 fbe292fe8230c6937abce5e685c93623f6f33cbe1f78add7926a4aa4d583628307c85447f5cd0b04df708460b99626a695ef82e0175ca4727c15a16d8a41f79a
TLSH
T195E0972BA0CAB04ACFF0033240E4BCCE84470765F2080B23638525CC33171E0420BC3C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 7a67b02740b7342aaffceea45f121e03b8043b7f9fbd016cc038dbde8252f406
MD5 6f7fe344ae2eaf4a377b757278c17fb7
SHA1 3f9b7d4ebe117b67cc16d2d9e0b426eb983e3935
SHA512 6519bf8ca2bccb73e656ed006bc1eacddd89911806a6adc5d01d47a23fd250b22209571506a0eb7312188cbba0d269a118db845e62d992267b3409424884e1af
TLSH
T18E2193A669C23E8BCFF382F6E4997CC8688E86D435040E3A030952CC2743CB0F10292A
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 6614d99e7c3cd84146db98cf21922cbb44658d293b7e86bde2adf28be53114c5
MD5 3888dcd36e8c1123e6dbf5e3a1b70c29
SHA1 618f62b986e97f1ca706a6ec43479998e6bad898
SHA512 1b579307a90c4b4f31f352df584a2186e98d4911a5e5065e9ac20f29f26aa62652a479c4a61b011d9e43432e0457cfcd40eb29b416848d53670c5b5997a70dab
SSDEEP 384:D3YzYJZ8SuJpJJjWwL4aMlHhJKVmj4mlasdYQBifFqNeWwQMXUNVbjX5pWQGX6BS:KvhXkuUkL
TLSH
T1CF429EF7C3E8C66DC91162F4AB256E1BCE191914431C3C67C9D4BF1BA3E28B1E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2ff971c866053b95ba62ed9170b71cfad169c409d0f203419cc644c4a5b55b72
MD5 b71ab544738446a822e90310864e779c
SHA1 5b600b1faa1f2029449bede8bdd5a2b987d4dec1
SHA512 a3ee922ccd60009e02295ba0198ef11c3bc2abffc6d730dfc0d435129f0fb86ed9fa9fe3fe5d8f24fbd90f974ae21d08929d57aa9c00151b48f65d6287933c19
TLSH
T193718BF7C3E4CA7D991152F4AB256E1BCE6D0A24031C3C66C9D4BE5B53E2872E20179E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 833adf14e2d771399d670b9bf2e1e30f9bdc9cf2d1eb2d663248badd829393e2
MD5 218ad5c25d0564fec61b52b79d7299bf
SHA1 fdfdbeb4870bab9e47e636d179985f0d0438d552
SHA512 36e0d6ff4d987802388694338b16e6006bc11298ee291abdeb7b6423d5f61f672357160531c680416569c60d89030cccefd4b861933dfdc49aa8087878f147d0
SSDEEP 192:pRcQCWFv7hwPRpyiP98Hsb+WNnaRt8TerBeMfVyIsnAUgE:pRcQF1sX1uwYmet5E
TLSH
T1E442B71EBE54697B6DCBD219F9267B93E3F5102262D02E84EBFC8A6C11E75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 5f84fa39d5faa74a9b1ecc51f7e665870e6fa3471ff0c73936e7bc98260e798c
MD5 e5ea6903def5e103f76ca567dd046e25
SHA1 adbf7c7f8c64ca145c48f6bb840b54cbac9d3263
SHA512 4f3ffce617cea86e7334dcbc4aef521e478aa48cd31de4702cf6b89d9a9391232788594904eea3b075af9837e842ced7b1adc57b110c6c2c5cc7a415f852de2e
SSDEEP 192:pRceCWFv7hAPRp2iP98Hsb+WNnaRtoPMQ2JgBeafVyIsnAUge:pRceF1AXpuwY60Q2JI5e
TLSH
T14A32A52ABA54697B6DCBD219F9367793E3F1102261D42E84EBFC9A6C10E75CC621700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 ab69b3170774b869729a8b714a8a3923118567a6e65cfad87051fc56beba454c
MD5 89c10d18a94f92b38d081befb71b81b5
SHA1 43af6c1288ae543339e4521a5e1afe188886e9f2
SHA512 3ec89ec0f70dd3127e4f5999de19df4752b402d7e5ecac78299979d27b260c8e5e399e354a4f3698f7b57c9dedee460c28b7acaa1ec3ef479a80e5a821338ede
SSDEEP 192:HRcQCWwv7CwPRpyiP98Hsb+WNnGVA8TeJBeMfVyIsnAUgE:HRcQFsXX1uwIfeL5E
TLSH
T11B42B71EBE5469BB6DCBD219F9267B93E3F1102261D02E84EBFC8A6C11E75CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 621963a8999c5aea46b729e66e063e86a6d43b00c7d77d226acf0ad3865294e2
MD5 8c97b891f0472f9f9e58eba467171553
SHA1 f24abc8e61b8140ffa0ee92808555691bc938c37
SHA512 4141708005faa7083860612a56cb112450a409660f421757477d95fcce721896ab874b165f367fbd186489ad58a061018585e9c7caa472b112c7b18f411ddbae
SSDEEP 192:HR8cBhQCRuv7CwPRpyOnQ+Al98Hsb+WN/NGVBErr8TeDBeMfVyIsnAUgE:HR8mhQCKXXeuw2aMel5E
TLSH
T11B52B65BFA506ABB6DCBD219F9267797E3F0102266D02E84EBFC8A1C11E75CC6217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e021a4caf045a14b48ed6e650d407a794c75d06230836110e6474f078915aa92
MD5 254aec2dc45100cba1905f3fb63bd831
SHA1 263f82fa3da715de8a947106b31f7a543cd3999d
SHA512 c5d6ab4c480b4920942c6a8aa30a1118569c2acfd611ca13819994b51b9fe5dd38011eae3c54367975d06145ca68563ea6df136a630af017ea5303474d7f3ea4
SSDEEP 192:pRcQCWFv7hAPRp2iP98Hsb+WNnaRtoPMQ2JgBeafVyIsnAUge:pRcQF1AXpuwY60Q2JI5e
TLSH
T17432A52EBA54697B6DCBD219F9367793E3F1102261D42E84EBFC9A6C10E75CC621700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 01432b1284267835c8cb688a18ed84b32fe4a9f22b73c369168d155e558afb47
MD5 2e42adc7784f2cafffd40aa0e3e44704
SHA1 0a41b7c44256061b5617b0483b4da8e2f952b495
SHA512 aea43f5ddc3689650c857ba1e519c387c1862d3a9801f03e080f136f2884e17b2036570e16a948cb3497b37ea46f77f94302677bd422717afe96a00edb69abb9
SSDEEP 192:HR8cBzQCRuv7CwPRpyGqDP98Hsb+WNnGVBBOD8Te2BeMfVyIsnAUgE:HR8mzQCKXXAuwI6kec5E
TLSH
T11C42C71BF9546ABB6DCBD219F9227797E3F1102262D02E84EBFC8A6C11E75CC6217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 5274955e8f4f6fae1223338c7cc39006671e0fe7a950d59e204721209807fac5
MD5 a99315ae39bbfabe5be9ebb54b90f56a
SHA1 25e0342ec3bae090aad806e5c070369e634b852c
SHA512 62d2ad9f3eb9be4b0a5ee67b6325108909598ce06c045b8623890aa0d18adcac78e3bcc9550894b5cad42b8007928905cb34c63482076db576e80c233a341b2f
SSDEEP 384:Majm97KxkXqKf/pUZNCgVLH2HfgslN1XODmd+ErU3oVHG8t2rWgH:MKm97KxkXqKf/pUZNCgVLH2HfgsLROqg
TLSH
T14E52E867684D9A7F0F98C98CDC176F8BACB5015762780D2456FB5D0803A57CF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 1b7ffcb65e2b22ac513448f354b06dd5a0245c582ac9c8cf0df4398eba67a190
MD5 756ddd9b5688b4d329540d2b0e3ed883
SHA1 c80747448b46fa5ca401d0d06f8085cc3a87cfb5
SHA512 37f8d79fb58d249f77b6680ea5402b9b27293e9b5eb21a44b29bd9a6c67f47083b85df78597240ea439144d90a2d633fbf808775792accbb086e5234aad2e3c3
TLSH
T170B0222820083C03E8BA0BB032C830803BE00C00230FBF0280808B208E22203CA02338
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 9d230baa1fc2ad2493ff74321b028080edaeb6f453183082cb1938492df1f90d
MD5 227089dc9e537b968a1a60a9f0115bfd
SHA1 ac935e9f50995a79030e27f3e830e7472f50ac06
SHA512 3310d0cffc56ab123fc724a2ba4686644452d2c2c1dc41a416de040c1c3808740830f76fd61d8de1a1c32a29f8cb78908ce0d70474ecad3553e2f9bc5cbb8c2c
TLSH
T132A0022119D14915CA806A71968105C06B6468985305C30381A1944CA8A6A47A902260
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 fe3ca45b180d6dcf79f42682fcc8431ff3bf6837f699fb030c78b85ec938f3b2
MD5 a56410d55af22fe6372dd0b93138190a
SHA1 5bd6076b679c1be2e715bca00276b9be85761efc
SHA512 e518a048cb5c0871d54c24878897f426b4d7f1f82b09464e2bb7eedd0f7f8a3eda2ed97fd2ef06e2ec99a892183cea8b614546c73b6b02713e88cb79c335a65e
TLSH
T14DA0021641D02819ED529271A07107C1E7574E581DB58707949A245D89EF1C6452115C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 483f8a034d2bb0a95158317ba9d04f9162e8760231181fe08fa952a446f3e173
MD5 c7d95df2df4b90ff32281515b39a5051
SHA1 57c5539a515fe9b493b6ec59022e57046226502f
SHA512 47f32c236ca0d74a03d4fa64b87c13302f5980481de2537df57935f6c8814066fea0a1bd9d1020ce1b93e67609114ec91c3870a31829241061b4fba591675a82
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 02f41e7084d57bd55fa2f4440c83b81fb4c3ae118a8c256c40770198e1656f75
MD5 90067b80261481152d7642ca6042adea
SHA1 9ff278d1bca88e15b1803f47d10eff8a26d7f13d
SHA512 93c18a972c43761d8b529e79b3e0d8f9e26bc3f44f094e083bfe6bfc09a1e0a99f5175e3e672b9d103371a57cdae39346612e7576962af8b741170c21db14875
SSDEEP 3072:8gPY/4IM9wkwpF0vH28dVjxY8Qhib+UT0fKaiJb52m7f117+:5wowkg0/pVjaTib+UT0fbyb5jd1a
TLSH
T19BC31231D5EE94FA42B3DAF0B68A3A4E9DC155731D30ED89A9302E4307BD463C68BD46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 b5c687e6d94779f7f229202db51e6f77bf76ab3f81ac0baf7ab50aa781d53b7a
MD5 597f99fb1aa2f62c21daf303142d5462
SHA1 c830e6efb7a20b2e48b606d2b62d5259450125fd
SHA512 2ba4298f48bd18d54c8029a91358f19cca3050e3615c72d0a85763a400a623678fa2e347e449d12ab540f1e7f60a70c52e5976e1a73c06641be832142b5a6043
SSDEEP 3072:dgPY/4IM9wkwpF0vH28dVjxY8Qhib+UT0fKaiJb52m7f117+:Swowkg0/pVjaTib+UT0fbyb5jd1a
TLSH
T12FC31230D5EE94F682B7DBF4B68A3A4EAAD105731C318D865A711A5303FC463C68BD47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 6b52068b8c22c85f59a4e46896ff11cb7ffe87d1db5083629f25fa71c2c6b3c2
MD5 248aaf6e58fd6e26f2d669e80a73cf46
SHA1 940247e49bede7a66558a6e8c4b09e3ac6aaf1df
SHA512 d318f1c6c4616913c12721d238123e5cdbadd27dfb292e1d5248705c471363636e197d95cdf6d7c361e96321a435b514dc8f1c6d1b9f612db2a4cb8a91938fec
SSDEEP 3072:YgPY/4IM9wkwpF0vH28dVjxY8Qhib+UT0fKaiJb52m7f117+:9wowkg0/pVjaTib+UT0fbyb5jd1a
TLSH
T12EC31230C5EE94F682B7DBF4B68A3A4EAAD105731C30CD8659711A5303FC463C68BD46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 464213d3ad7fb66902d98b6c5719b615aff45d86d1810a8b36a570e1da63d53a
MD5 526ba35874de17127508285e7efaa99d
SHA1 8534a02544adf90985c9b31e302a131cb9e025da
SHA512 6a58de71f4d0d82c7f4d167ffc713444d8e5ec1e4654f4483d8a0353a717ac8f26fd427d655229c29b70ef2bcb9ec6dad807bf9c7a95ae9cceb194a9ad0716fa
SSDEEP 96:5KC6jd+oJm4V0FH+pqf+HBKyoytsRDotok5UHDbCB6eGyvkonNob1v4a:MCIHJm5FHuPgXDUDmbCW8nNobZ
TLSH
T151A11AB1B8B94CB719B7C245F9933A83DEA4A2176590EF84DADD0F0C11F31D81341527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 65bd3d3ed03e510f53c78619495a60490f9d89a251591d289c99212e0b0405c4
MD5 c9bad6ab6a35b10bf6db3a350d424386
SHA1 35ff2d47d24c274517ec8632439f5d7925c4e79f
SHA512 c0145682839626f57492c525fcf5c996c679410040568ebf67f39b497ce709c85c30c3dd6a0112abcc59423c86bd909d49546a7cd319c06741fa5e75b173603a
SSDEEP 3072:DgPY/4IM9wkwpF0vH28dVjxY8Qhib+UT0fKaiJb52m7f117+:kwowkg0/pVjaTib+UT0fbyb5jd1a
TLSH
T199C31231D5EE94FA42B3DAF0B68A3A4E9DC155731D30ED89A9302E4307BD463C68BD46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b08236da8cd970595ee637755046d13

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\6b08236da8cd970595ee637755046d13
Size 322KB
SHA256 2997be874355e3ea9bc36c05fb7fc9b9a2a8e6da87d2014ecfbc8b95f77b5686
MD5 6b08236da8cd970595ee637755046d13
SHA1 109114621c5a8b85ff7612d0ba2c17616fcbe536
SHA512 6f496266dcf7e3885791c0aad0703240dbc68f632f05102c482d8db7cb7dc9b79013f93b8ba7cf2a081cdc2772b9f5121d4f88aaf219b91161754d873dc3a217
SSDEEP 6144:j7bhY6n1UVvdL3rfcsbR8cN8wOcdm/B+F/s7Caa8sjGOFisi:vxyrhbJ1Y/cSTa3hFi
TLSH
T108642339C802506EE54A71BEF48BA523FCE407C38835096F76D6A47086BF3D3C1BA946
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb9dd4d0637fd6ae21747e6b6a281d21

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\eb9dd4d0637fd6ae21747e6b6a281d21
Size 459KB
SHA256 5a3aae5657899b6452004f3f43f122cb6c166c99b7261efbeb965da906626ed8
MD5 eb9dd4d0637fd6ae21747e6b6a281d21
SHA1 387c79caeee5a5a850e328f8b9ce812b5048cefd
SHA512 f9b87df46149f2fe52690e3c906ee1cfc92e3196b8db50210269312999a56b9aff354b1b5c74da192b37646dcee5305d8afde6d2c80334a484b1a8a375950b5b
SSDEEP 12288:CtpZwzl7szmrFyHHU8ibAQXgwntX3dh7ZVNx:ClGl78WKHebAKtX3D7ZVNx
TLSH
T141A4235BC725D298D9A2D17EE22215BD68FF29AD8010F52A08015E417FAE70D6FF02DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem
Size 223KB
SHA256 2eba303a7b3c87f0c52fa8f977b703ec6dea7de703f97644546d2d34e53e4cd9
MD5 2ef00fa979161001a3a5cd5169a7de48
SHA1 0d3ee6044ef954db79d4db9984cad411dfd4c3c7
SHA512 f0b7f015d3e766b390a663ca5b1498175fa241259cad73f4b8d2b9646b56bc08a698fea7f5a28324b9a59af1622296ef79d77830a50bce14fd5f02f7f9228fdb
SSDEEP 6144:EqU9NgI6FdZL52dTOgwQh1hV1AP2A2FTR:knh6fZL5mOi1hXAP+9R
TLSH
T1E624AEAACF953C4A28E3F094C9AB037ED919C3629DDAB0B31D593845C78972D61FD08D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8913724486d5e3c463c493b25346ca31

Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\8913724486d5e3c463c493b25346ca31
Size 64B
SHA256 733641d94b2a6c97570fdff184d8a092823419eda7889f7e136dfe1bc0bfb639
MD5 052a6ad73ac8bfd613c76ba4360ac9c6
SHA1 607aacf5da8cb596c848990feb0c771e7b89aed1
SHA512 7f2d7e1605b6b43516623620148a9075f6053a57259b470bad7a2e94b0ee830a1299ff34375c1e99f53d78a4bef261e45d905220acdd6c2c16624b2552c49727
TLSH
T140A0220B2082080082B022A8380E08E838200302A880BB800302A3C208208FFB0088C2
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2548_1927189464\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Unconfirmed 647613.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 647613.crdownload
Size 13.0MB
SHA256 e5704c36a3cef626b86c31b404fa31120fdabc70188540157039a0bda68a7870
MD5 db08dc7b734bfeec9653ac1d0942f73c
SHA1 520a9053589921bb4e25030f63be2514f3b0f953
SHA512 b2624417ee4d4dc719d3e21361690c0e615f07b6640a67d8086a5153641747a6245d20ae3495b8e50e5fc84612d04eca2bac0b6cb5460950b91435be515a4b16
SSDEEP 196608:QHnuOb6I/gC+uv4OYu2fKEES0jvlzhhw7V5l:QpOug44OYDKEP0jRwpX
TLSH
T1B9D69E6AA2B800E8D4BBD178C6565617E7B1B41603709BDF17A046BA1F63FE02F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download