hxxp://google[.]com

Analysis

user interaction
yes
max time kernel
483s
max time network
492s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 02:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://google.com
Sample260723-dg4dgsdk21

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
153	3548	chrome.exe
226	7796	chrome.exe

Executes dropped EXE 15 IoCs

pid	Process
1916	Bloxstrap-v2.11.3.exe
2824	Bloxstrap.exe
6612	RobloxPlayerBeta.exe
6628	RobloxPlayerBeta.exe
7460	Bloxstrap.exe
6500	RobloxPlayerInstaller.exe
3368	RobloxPlayerBeta.exe
2968	RobloxPlayerBeta.exe
364	RobloxPlayerBeta.exe
2332	RobloxPlayerBeta.exe
9692	Bloxstrap.exe
8448	RobloxPlayerBeta.exe
8472	RobloxPlayerBeta.exe
8260	RobloxPlayerBeta.exe
8268	RobloxPlayerBeta.exe

Loads dropped DLL 5 IoCs

pid	Process
6628	RobloxPlayerBeta.exe
2968	RobloxPlayerBeta.exe
2332	RobloxPlayerBeta.exe
8472	RobloxPlayerBeta.exe
8268	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs

pid	Process
6628	RobloxPlayerBeta.exe
6628	RobloxPlayerBeta.exe
6628	RobloxPlayerBeta.exe
2968	RobloxPlayerBeta.exe
2968	RobloxPlayerBeta.exe
2968	RobloxPlayerBeta.exe
2332	RobloxPlayerBeta.exe
2332	RobloxPlayerBeta.exe
2332	RobloxPlayerBeta.exe
8472	RobloxPlayerBeta.exe
8472	RobloxPlayerBeta.exe
8472	RobloxPlayerBeta.exe
8268	RobloxPlayerBeta.exe
8268	RobloxPlayerBeta.exe
8268	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\Emotes\TenFoot\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\Settings\LeaveGame\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\VoiceChat\MicDark\Error.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\ExtraContent\places\RhodiumUnitTest.rbxl	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\fonts\families\Arimo.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\rotationArrow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\PlatformContent\pc\textures\sky\indoor512_bk.tex	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\PurchasePrompt\LeftButtonDown.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_14.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\ExtraContent\textures\ui\LuaApp\graphic\gr-profile-150x150px.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\ExtraContent\textures\ui\LuaApp\graphic\player-tile-background-dark.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\ExtraContent\textures\ui\LuaApp\graphic\rocket_icon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\VR\notifications.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\ExtraContent\models\Photobooth\AbyssBlueLight.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\ExtraContent\textures\ui\LuaApp\graphic\playBtnBackground.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\ExtraContent\textures\ui\LuaChat\icons\ic-alert.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\FlatCursor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\SelfView\SelfView_icon_mic_disabled.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\PlayerList\NewAvatarBackground.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\fonts\PermanentMarker-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\AvatarToolsShared\RoundedBackgroundLeft.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\ExtraContent\textures\ui\LuaApp\graphic\gr-avatar [email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\ExtraContent\textures\ui\LuaChat\graphic\gr-send.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\ExtraContent\textures\ui\LuaChat\icons\ic-remove.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\whiteCircle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\particles\explosion01_smoke_main.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\InspectMenu\Button_outline.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\Settings\Players\AddFriendIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\fonts\BuilderExtended-Regular.otf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\TopBar\chatOff.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\VoiceChat\RedSpeakerLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\ExtraContent\textures\ui\LuaApp\graphic\gr-avatar [email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\ExtraContent\textures\ui\LuaChat\icons\ic-search.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\fonts\BuilderExtended-SemiBold.otf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\Controls\PlayStationController\DPadRight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\PurchasePrompt\RightButton.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\VoiceChat\MicDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\WarningIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\Emotes\Editor\Large\Wheel.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\LegacyRbxGui\ComboBoxArrow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\ExtraContent\textures\ui\LuaChat\icons\icon-share-game-pressed-24x24.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\Vehicle\SpeedBarEmpty.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\ExtraContent\textures\ui\LuaApp\dropdown\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\AvatarToolsShared\RoundedBorderRight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\StudioSharedUI\DEPRECATED_pending_withbg.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\Settings\Radial\RadialLabel.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\ExtraContent\textures\ui\LuaApp\icons\ic-more-about.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\avatar\compositing\CompositExtraSlot2.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\content\textures\ui\Scroll\[email protected]	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3548	chrome.exe
7796	chrome.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292492037915054"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\roblox\shell	Bloxstrap-v2.11.3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\roblox-player\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe"	Bloxstrap-v2.11.3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\roblox-player	Bloxstrap-v2.11.3.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\roblox-player\shell\open\command	Bloxstrap-v2.11.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0200000000000002	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-9affbe66b2624d20\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-9affbe66b2624d20\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\roblox\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe"	Bloxstrap-v2.11.3.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\roblox-player\DefaultIcon	Bloxstrap-v2.11.3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-9affbe66b2624d20\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\roblox	Bloxstrap-v2.11.3.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\roblox\DefaultIcon	Bloxstrap-v2.11.3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-14d8b191232f4ddd"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-9affbe66b2624d20\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{AB7DEC57-51C5-4B5E-9F3D-D8C73EE3250A}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{565712B6-393C-441C-9579-CB277F228014}	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\roblox\URL Protocol	Bloxstrap-v2.11.3.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\roblox-player\shell	Bloxstrap-v2.11.3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\AppUserModelId	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\roblox-player\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Bloxstrap\\Bloxstrap.exe\" -player \"%1\""	Bloxstrap-v2.11.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{432A524B-E9D1-49F8-B73A-F0DA0F66C7AE}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
3280	chrome.exe
3280	chrome.exe
1916	Bloxstrap-v2.11.3.exe
2824	Bloxstrap.exe
2824	Bloxstrap.exe
2824	Bloxstrap.exe
6628	RobloxPlayerBeta.exe
7556	chrome.exe
7556	chrome.exe
6500	RobloxPlayerInstaller.exe
6500	RobloxPlayerInstaller.exe
2968	RobloxPlayerBeta.exe
7460	Bloxstrap.exe
2332	RobloxPlayerBeta.exe
6188	explorer.exe
6188	explorer.exe
9692	Bloxstrap.exe
9692	Bloxstrap.exe
8472	RobloxPlayerBeta.exe
8268	RobloxPlayerBeta.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6188	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

pid	Process
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe
Token: SeShutdownPrivilege	1184	chrome.exe
Token: SeCreatePagefilePrivilege	1184	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
2824	Bloxstrap.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
1184	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
7556	chrome.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe
6188	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2764	StartMenuExperienceHost.exe
1488	SearchHost.exe
6188	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 3384	1184	chrome.exe	87
PID 1184 wrote to memory of 3548	1184	chrome.exe	89
PID 1184 wrote to memory of 5376	1184	chrome.exe	90
PID 1184 wrote to memory of 5376	1184	chrome.exe	90
PID 1184 wrote to memory of 4484	1184	chrome.exe	92
PID 1184 wrote to memory of 4484	1184	chrome.exe	92
PID 1184 wrote to memory of 4616	1184	chrome.exe	93
PID 1184 wrote to memory of 4648	1184	chrome.exe	94
PID 1184 wrote to memory of 4616	1184	chrome.exe	93
PID 1184 wrote to memory of 4648	1184	chrome.exe	94
PID 1184 wrote to memory of 4788	1184	chrome.exe	95
PID 1184 wrote to memory of 4788	1184	chrome.exe	95
PID 1184 wrote to memory of 2252	1184	chrome.exe	96
PID 1184 wrote to memory of 4216	1184	chrome.exe	98
PID 1184 wrote to memory of 6092	1184	chrome.exe	99
PID 1184 wrote to memory of 4216	1184	chrome.exe	98
PID 1184 wrote to memory of 6092	1184	chrome.exe	99
PID 1184 wrote to memory of 3232	1184	chrome.exe	100
PID 1184 wrote to memory of 3232	1184	chrome.exe	100
PID 1184 wrote to memory of 200	1184	chrome.exe	101
PID 1184 wrote to memory of 200	1184	chrome.exe	101
PID 1184 wrote to memory of 1312	1184	chrome.exe	102
PID 1184 wrote to memory of 1312	1184	chrome.exe	102
PID 1184 wrote to memory of 5672	1184	chrome.exe	104
PID 1184 wrote to memory of 5672	1184	chrome.exe	104
PID 1184 wrote to memory of 6124	1184	chrome.exe	105
PID 1184 wrote to memory of 6124	1184	chrome.exe	105
PID 1184 wrote to memory of 1376	1184	chrome.exe	107
PID 1184 wrote to memory of 1376	1184	chrome.exe	107
PID 1184 wrote to memory of 2736	1184	chrome.exe	108
PID 1184 wrote to memory of 2736	1184	chrome.exe	108
PID 1184 wrote to memory of 256	1184	chrome.exe	109
PID 1184 wrote to memory of 256	1184	chrome.exe	109
PID 1184 wrote to memory of 4392	1184	chrome.exe	111
PID 1184 wrote to memory of 4364	1184	chrome.exe	112
PID 1184 wrote to memory of 2472	1184	chrome.exe	113
PID 1184 wrote to memory of 5284	1184	chrome.exe	114
PID 1184 wrote to memory of 5284	1184	chrome.exe	114
PID 1184 wrote to memory of 2424	1184	chrome.exe	115
PID 1184 wrote to memory of 2424	1184	chrome.exe	115
PID 1184 wrote to memory of 4200	1184	chrome.exe	116
PID 1184 wrote to memory of 4200	1184	chrome.exe	116
PID 1184 wrote to memory of 1688	1184	chrome.exe	117
PID 1184 wrote to memory of 1688	1184	chrome.exe	117
PID 1184 wrote to memory of 2056	1184	chrome.exe	118
PID 1184 wrote to memory of 2056	1184	chrome.exe	118
PID 1184 wrote to memory of 628	1184	chrome.exe	119
PID 1184 wrote to memory of 2636	1184	chrome.exe	120
PID 1184 wrote to memory of 2636	1184	chrome.exe	120
PID 1184 wrote to memory of 4628	1184	chrome.exe	121
PID 1184 wrote to memory of 4628	1184	chrome.exe	121
PID 1184 wrote to memory of 3348	1184	chrome.exe	122
PID 1184 wrote to memory of 3348	1184	chrome.exe	122
PID 1184 wrote to memory of 4292	1184	chrome.exe	123
PID 1184 wrote to memory of 4292	1184	chrome.exe	123
PID 1184 wrote to memory of 1088	1184	chrome.exe	124
PID 1184 wrote to memory of 1088	1184	chrome.exe	124
PID 1184 wrote to memory of 4704	1184	chrome.exe	125
PID 1184 wrote to memory of 4704	1184	chrome.exe	125
PID 1184 wrote to memory of 780	1184	chrome.exe	126
PID 1184 wrote to memory of 780	1184	chrome.exe	126
PID 1184 wrote to memory of 3280	1184	chrome.exe	127
PID 1184 wrote to memory of 2464	1184	chrome.exe	128
PID 2824 wrote to memory of 6628	2824	Bloxstrap.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe4703c728,0x7ffe4703c734,0x7ffe4703c740
  2⤵
  PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1860,i,18192466535299898989,14757715167345404129,524288 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2176,i,10920213471241699258,14278235706545697747,524288 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:13
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,7590606233784018291,1223326178636994111,262144 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3108,i,7287239519259648681,16054123140095726554,2097152 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3132,i,16897182663339283139,14710679578611174313,2097152 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4696,i,12597617224355510608,5670138344096236491,2097152 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5252,i,600171009094523780,5283910816764083693,524288 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
  2⤵
  PID:2252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5352,i,9162423077640437687,12882402251468303359,2097152 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5364,i,539849511027001793,13690109143364886604,2097152 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5648,i,3908920837737579138,4975287609794133948,2097152 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5816,i,16069068543849235214,1046453698141356101,2097152 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5956,i,5613776545186894181,17110952502760181486,2097152 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5908,i,4924838628505675056,4235821736761313263,2097152 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6036,i,3038104581442363351,14635978702791468073,2097152 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6220,i,12839101062797356501,15343209082898154135,2097152 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5840,i,1211177696996174460,18305343404645091064,2097152 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5784,i,17334209633863243126,14626574847310929906,2097152 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,17885201867867192251,14128296066497973806,524288 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
  2⤵
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6104,i,13151727527154598046,18087636472666993169,524288 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,11757549189000622814,9110738420702208771,524288 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6760,i,12852654334724665027,9091411378731869645,2097152 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5884,i,910963273945386039,1324556480787670314,2097152 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6568,i,11308353799541814381,8868257556079838382,2097152 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,10098596478420435559,17532423745532732729,524288 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:12
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6976,i,11391812013605924426,9566943126057710630,524288 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6456,i,1572658178686513217,839961009816210919,524288 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  - Modifies registry class
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6576,i,2516899453464352554,7517945335367347371,2097152 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5508,i,6711471341802533600,1460990253408805330,2097152 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6976,i,7099083472712993735,12170474498173490841,2097152 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6664,i,652108482218167665,13540613109886164255,2097152 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6832,i,15884233854499306701,13515760592268070528,2097152 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=4800,i,2688113731032662869,723092333960373575,2097152 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=5700,i,6210920627950824723,2310521527860220137,2097152 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6856,i,16081065504088673273,5505768567861340301,262144 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6844,i,3309095502120721139,3257158285394934345,524288 --field-trial-handle=2044,i,7271905858589013564,10979299153295102456,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
  2⤵
  PID:2464

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5388

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4904

C:\Users\Admin\Downloads\Bloxstrap-v2.11.3.exe
"C:\Users\Admin\Downloads\Bloxstrap-v2.11.3.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1916

C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe
"C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe
  "C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe"
  2⤵
  - Executes dropped EXE
  PID:6612
- C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe
  "C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:6628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:7392

C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe
"C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:7460
- C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe
  "C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe"
  2⤵
  - Executes dropped EXE
  PID:364
- C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe
  "C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:7556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x128,0x138,0x7ffe4703c728,0x7ffe4703c734,0x7ffe4703c740
  2⤵
  PID:7572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2000,i,3962155042076282907,14585507817284943571,524288 --field-trial-handle=2068,i,8671103125180241635,1664931973363909647,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:7796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,12220245654648932296,14218541800319463159,262144 --field-trial-handle=2068,i,8671103125180241635,1664931973363909647,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:7804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,49089518372431509,4723584626220752909,524288 --field-trial-handle=2068,i,8671103125180241635,1664931973363909647,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:13
  2⤵
  PID:7896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,9307924878095489822,13277865214875317423,2097152 --field-trial-handle=2068,i,8671103125180241635,1664931973363909647,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:7908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3328,i,3546629105578533776,619623116420210885,2097152 --field-trial-handle=2068,i,8671103125180241635,1664931973363909647,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:7920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4620,i,9940358672023750801,12544443821724155834,2097152 --field-trial-handle=2068,i,8671103125180241635,1664931973363909647,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:8244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4624,i,5213475774097210293,8758994823530639665,524288 --field-trial-handle=2068,i,8671103125180241635,1664931973363909647,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:14
  2⤵
  PID:8252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,12670028009159694428,2200694004316780024,524288 --field-trial-handle=2068,i,8671103125180241635,1664931973363909647,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:8496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,17992598000743386535,1173708268253621545,524288 --field-trial-handle=2068,i,8671103125180241635,1664931973363909647,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:8588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,3102884385059798240,6986754108561585290,524288 --field-trial-handle=2068,i,8671103125180241635,1664931973363909647,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
  2⤵
  PID:8764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,6479887123185521833,17246235759998578956,524288 --field-trial-handle=2068,i,8671103125180241635,1664931973363909647,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
  2⤵
  PID:9056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5400,i,5836510428616394526,2753370600912017099,2097152 --field-trial-handle=2068,i,8671103125180241635,1664931973363909647,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:9424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5860,i,13626172040443493269,284698840171481895,2097152 --field-trial-handle=2068,i,8671103125180241635,1664931973363909647,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:9
  2⤵
  PID:9432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5560,i,17220337284354033877,5636585783424208676,2097152 --field-trial-handle=2068,i,8671103125180241635,1664931973363909647,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:9928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3428,i,6367611665849346887,4770642095228461337,2097152 --field-trial-handle=2068,i,8671103125180241635,1664931973363909647,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:10136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,13811322814838166534,7046612544747080856,524288 --field-trial-handle=2068,i,8671103125180241635,1664931973363909647,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  PID:10640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5924,i,11862688901739131989,15835356057077031348,524288 --field-trial-handle=2068,i,8671103125180241635,1664931973363909647,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:10648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,3888901261285144160,15745218172235220190,524288 --field-trial-handle=2068,i,8671103125180241635,1664931973363909647,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
  2⤵
  PID:10656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6084,i,1397664949482414044,17738818184307663505,2097152 --field-trial-handle=2068,i,8671103125180241635,1664931973363909647,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:10912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6800,i,6880332389892554653,17318910100469481426,524288 --field-trial-handle=2068,i,8671103125180241635,1664931973363909647,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=6780,i,15080104058827566704,4673217315856142329,524288 --field-trial-handle=2068,i,8671103125180241635,1664931973363909647,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:14
  2⤵
  PID:2672
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:6500
- - C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 6500
    3⤵
    - Executes dropped EXE
    PID:3368
- - C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 6500
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:2968

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:7820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:8720

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4364
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:6188
- - C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe
    "C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:9692
  - - C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe
      "C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe"
      4⤵
      Executes dropped EXE
      PID:8448
  - - C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe
      "C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:8472
- - C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe"
    3⤵
    - Executes dropped EXE
    PID:8260
- - C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:8268
- - C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe"
    3⤵
    PID:10072
- - C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe"
    3⤵
    PID:10052
- - C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe"
    3⤵
    PID:10260
- - C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.exe"
    3⤵
    PID:10256

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1488

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.7MB
SHA256 0bf6d10b71b025e36af8802335cfcf5a693cb351731e6d3f56c9a9616ab2c4c9
MD5 6a2df518995fce2ec395becd750fbb69
SHA1 8f40283d158a0db74743755bc6e356f3de4f0e21
SHA512 ff1c2fe1cb904a2cb0846b3e314e4f2c02aa2945b389bd94f1ac7bb7d66058d222970c7334a577430c1f2498908f50d077560c0b032bfc12958179dc3c4b8e88
SSDEEP 196608:Lqrajgrui7KiWARoWQb5amsxUMRUFUnvTBDbBQ03O:Lm77KWiamsxbU2nvTBiQO
TLSH
T1D8A6BF22BA00C032E8D100B296BD5FFA997D5A341B3954D7A7D41DBD5A306D33B3AB1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClientAppSettings.json

Path C:\Users\Admin\AppData\Local\Bloxstrap\Modifications\ClientSettings\ClientAppSettings.json
Size 56B
SHA256 9b14564577c6c9185200d86d6d36aec65db3652c64f5f594587132fe51c71994
MD5 d858cd3115fea6ed7af33730c08b3908
SHA1 cbef23640a7afd4e40ca030695139db9710fc827
SHA512 341506375cba76a8cffa514bf1c113f056408acd5f36ffcbae2a89d875b964c9b86ab7c9401e7074862a3755c1e9163479d82d68953a3e17a8df37a5587edf19
TLSH
T173900274C8169157666455CA141165831674470E05222595D111699B267D6140544715
MD5 SHA1 SHA512 TLSH

Submit Download

PlayerState.json

Path C:\Users\Admin\AppData\Local\Bloxstrap\PlayerState.json
Size 1KB
SHA256 4677b6a8ee73b661d578b1f9414558ac2f495057b7a0014b2cad88e57c8c7300
MD5 337bc507f813347ee63046125124d6c6
SHA1 0de6e3369bb7041c5ee9fb98ea565d9c44710344
SHA512 0319778df843050d8a48fd25e3acdc1de24e7f74adad3247bd9800ee5098b016bb00fb19bb7cf0131aac8fcc6e753b7910893bd843de08146f179e4a507941ca
TLSH
T1CE3196B2E8948D7B17FCE23954146750B502A70BE9D3184FB134638C2FFD3A901C3669
MD5 SHA1 SHA512 TLSH

Submit Download

Settings.json

Path C:\Users\Admin\AppData\Local\Bloxstrap\Settings.json
Size 696B
SHA256 cf435f67b67d1e06baffecc06806074423c38c75c052f5f304ad732106ce94e3
MD5 508655325b00a14e5b27ef5cf764df4d
SHA1 af63633665ed01c39e21ce9e0d04c0aae6610370
SHA512 119d6a0c1786033ca0c15a41b2a84923998ffa718e0f9672f4482e48156e34f386c39868b1dc58c1854b51da46325dc9c7107f95dbf2f2f79ab3e2880b6637fc
TLSH
T1950126419A61A5F905FAA62C941CE1421A668F7B10740C2FB7FF960C1262A3B3352F99
MD5 SHA1 SHA512 TLSH

Submit Download

State.json

Path C:\Users\Admin\AppData\Local\Bloxstrap\State.json
Size 168B
SHA256 e5811ac3dadf2ad89eb84ac83975c67ebe6a5741fc550cd24665c32cce288c4f
MD5 2e9be4fdbd0f7e5c2fc0d6f380ef5651
SHA1 bd4d95f34d3298e0b2eeff9447e794344be9110b
SHA512 2b46c8163732d4a21b0970833b1c59723efea1ed86813ba939a861a7cd6c90257d5a52333df95f18461bc9230e9ef49d94a6e11f679ebe92357c4c939aba369b
TLSH
T1F5C08C19E1082DB974B8178981AE0B40DA1F2723A0600C2BB3FB010D9E35232208EEE2
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-9affbe66b2624d20\RobloxPlayerBeta.dll
Size 20.9MB
SHA256 6b2a8fff0916ea0fbb5c4014c5c7d03fc8d49d7e83963af21ad103a79ee136e2
MD5 6e33fcf572d401c6a42a23227e7d9c7a
SHA1 a9e63fd1a22daeb5cfa5a93ba8254e432f6683e4
SHA512 6c6b898224904ae9dac2c2df294b6d1d84ade789365adb4eeda354b8d4009e1989a0cc135b6d1d283c1c296362aa4983e5ac9783f8666c8f6e219f80dc72f9e4
SSDEEP 196608:POZG8A5f0AmsT5usFj4XU51eVZy722kqJVTSfacRSAJYFQ:PgG8A5pJsB01ePyi2XbTZAKF
TLSH
T13427AE4EF4D60AA8C2B154B1D05F96E7E661318C0A693EF349DA0221333379E665DF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 0348e188ce947271b1b49a9d58c1aaf1347e158d5de7ee8e42117c3b3d0a6c95
MD5 68c498148bcb2812bdc36d43cc0bb9c6
SHA1 f1a9976f5355ea5ad308c0e75210111fc74d8805
SHA512 9e183181a5fed97ca4d84032ba5cd14472bf475c4fc6b51eb28ada951e40ee94a9a80000a9dbe3e016f742118b2d359229f9b6a80254f616854f8ddc8de92da4
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
Size 373KB
SHA256 00dcd72487112e44ba2487e5eb363a98d65f14344edef5293c8e9dd52850ee58
MD5 ad6388a08d35f6d67db1213404b7f81d
SHA1 55cb415cfa760fb4beda8422d7c635cd4caf1915
SHA512 1b92070f13725fbe34b18dce86e09ee76536ef7dd7190f2c11d54f71b91acdfd40f03c8972a85099b988fae24eaec038be967cbe7b57783340140481b9362248
SSDEEP 6144:qm2dRYZtgXkt4w9410UKjgGHjMaP8RVkqSRhP58OU5R67u4nORWO7lQ8E9:C8tg599lGDBskZP58B67znOwGQ8E9
TLSH
T1A084232C983F6900BB0252741FD6C76E4FF40988A2C0D4C28254A193F9B7EA7F5A7779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000028

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028
Size 436KB
SHA256 0b320d2cf00e9215763a5377904e2301b2edb7a5d299bd319259714cf8bcd9a9
MD5 38e965609b7e0769e6754549cfa3c2fd
SHA1 8ef9e62fa3ae6d8b371f5a9e9344a6cdf31515fe
SHA512 18cff962b979abf3e3d06261422f35502463a0e196aa0cf801cadcff8833a83f20c9e9f22fb3133041e406fdf2304088a0a5eaa4bbb8aff07ab15a0c1b46b0e4
SSDEEP 6144:HT+7EhQjYpz+XUGr9+7Km54TxcjJJEWv6p0qOJ7kuKtAiDL6GnkES7+S8HBWzDi2:6vj0iUI9EKFEJdU0p7riDxw7L8oviJ3c
TLSH
T147942367DF08D99BDA158361EA30EBDD1158EB6EE00A3CC844BB462CE54C0F9F6913C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000033

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000033
Size 21KB
SHA256 827c2a2effb07cc4b1c55258223ce5af3e42f35643f91893b49ef2d8e16bbddb
MD5 a862dcce22578fc885f0d8350012e9ad
SHA1 c4c70bf38b6b83ec579d61b5e36d739928b7d80c
SHA512 8639a7c6ba1a99f394a2d7f9f7f5144affac8047a34d8653a1d2e257415177828ed49b36b33d062edb7cb9e6ef89bfcbcbe717a69c3120744c2db719ba451df4
SSDEEP 384:ncS/kaADMv3H5OuPEjUAFH0cythGyUCS3OEigedJYCBObMrvoFGt4lVDotOqInx4:ncAn4O3HE8AFkddci5dJtMbuowt4l1o3
TLSH
T16AA2D07D3903F1609FF9906846FB9A2F437C7D1E07A0D9925C6B98234D3F2890D629E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003f
Size 61KB
SHA256 ea8a599025f92a3439a4a027bcf8021a04634bc0bf554c11a1fb730b77caac01
MD5 2ecfb3e9d7c32f1ca2daf49ec21610cc
SHA1 d97fe3a1ff867be6f8ed362d66d4d7ef585d5a30
SHA512 18e207276b507dff5c6fddd9752c1626258f0f09548a7bc0477fb5d29e3927d9f97c6f73ef5d4bf080e6f637b4e279ab008dceacb9e163e5042aed7e7f952e8f
SSDEEP 1536:QUPVl4cCBBKwVXpiqKIAePOC9Hu9CdKeAXT5K5+uqQgyGUZ:VTKBLV5hvAk/pu9w45K51VgJI
TLSH
T1D85301155B70DFD03DED743BA179EC8662E359F746666A430A1C00BDC3F8082CADAE05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000040

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000040
Size 44KB
SHA256 2e94ab0f64c111deeceb195b4d288744feb0025174c6031e6d6c49a74c40c623
MD5 57e64a57754247732dc87b66081fc02e
SHA1 60a5aa2d9b778c64d0e06dd4c7cbb385d8b41400
SHA512 ee2b6884f70135f4a3fce0dc3f117719ea7d3931ba389a80aa2e3020838b8c004babbd0236d3667d110237049c52b424fd63cb58cd9810d177fcb3de49340875
SSDEEP 768:9vwNm4XqZpWVE8aWhQ0qEG13o2bOJanPaR5wiyOYS2CkrIilGkRlGAIQDTlr7zoF:9JMqTWe8aWi0qH3o2bO6aojlvNIsRr7q
TLSH
T1B723F2A3EDF141FC5B18C3B64A79DE6195E993583A2BC0ED12A1CC1AD8E7500354AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000041

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000041
Size 75KB
SHA256 299e8bc4ce910715a1eee7cc22bf13df373f38b6b9470865288e6535c7a7662c
MD5 05c9624ba70e9a8c17b82e6f49d156d5
SHA1 20c36baaab25d8c90f49c1f15ff65c57c83554ae
SHA512 a3175d5b63516bd4ce6fabb5acab1b4d08dcc1ab0caf066ce5ac5809add636577181e2b84a986baa21dba64769ca19c9d296118bd31578401fd2a6b89d878148
SSDEEP 1536:vs4hXgKlKw8H3mWAombiIrC6b3XC/U7Fg064cANUhOrA3zVzkbT7ECqEGfh:04pgKOH39AombiIrJSsV6VGNrA3zVzca
TLSH
T1F27302EDD7E7E74469E32846FC422F25A66FDE0D16A9B61351C8AC06DC6C044BF482B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000045

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000045
Size 72KB
SHA256 352d8065d9daf5577058c801b9fde8865deae60e0aab039fb2be5fd753d1cdf9
MD5 c17b71648f362502f3d2a91f5c43b7d4
SHA1 58f6aee0cf1310a995cacb570518c27fc1812794
SHA512 316b44060efda518622c8de47dd69fa89564aa66733aa24d4219be254694b00db0247b66be21b506f6fcd3906d5116e174c1ed1fcf60f093ae285ead141ca299
SSDEEP 1536:SxODPiVesipDxQJHVSZjHNeakRhIN7yaqi4FNRMV8qn8xviol:WODhxPjtedDiyaNcNRMV8g8xvBl
TLSH
T1977302F235ED314BE94239822245FD4E7C8B14D5C683836922CFA8D907B8FD56A6217B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 7d350ae9692e213322b5757a75417a72a0f475bdb8a66604d1d884eba6aa2b55
MD5 93cf6b376b095aa72ea5bb0b4ccea981
SHA1 552d450cc006057b729096659d9d18dc353da7b4
SHA512 5216ef730d6f9fe30c02db49e012fffb3c5ab41ed8e47e62542aad168e36388aaad8a1a33534bf2bc93f7cb138dc9e8f24a4aa878039c5673553817bafe17f8d
TLSH
T17471524C70D6C102EFBBA27422B97D3734290A7202671BDD8298F714B107AFE2D97456
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 185674fbc33859852bd26fe13cc8c80fde917587986afed63a0a9553e556a60d
MD5 a0f03465e4216574fc2949b5229ff133
SHA1 418596dfcef565d9d6e17027d55ec17a66440eea
SHA512 205df04bdd1995b15d8558658624f16b4f855772f03f77150ef126a2dff0f4366dcccea9895cb4e352b41c069b2a5d7270ece1004ca05be6d6e07fce95b2f800
TLSH
T10281610C74D7C102EFBBA17122B97D3B34280A7202A717DD8684F7147203AEE2D87455
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cc5e2402cd6f3fd6532890cda27b079dc9557d8b37e48c956b3993c7c4803e08
MD5 60a057b264b56b676cada1176c3aa194
SHA1 a80d18d421f9f30d928b76fb4637aa8786e3259e
SHA512 4e36ee16e6aecfcb6e98877568789bdbab1a94c58efbe7d81c4dc992f552c73a785279b6bfadf846ce33e14011e1e37ca804c7238a53e39d50f60d9cf47edd10
TLSH
T14571614C30D38102EF7B627022F9B93678240A7602762BDD83D8F714B107ADE2D97856
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 2d74960a05968b85504623860a2d2994a824ab6b6f7303a037cad1a7d2312a69
MD5 4d191b94bccfb9a8b40108ae4ab5bd6c
SHA1 d3bc56b3c3d270dc3c32fefd8cfda67f6cfd06f5
SHA512 38a78ce0a70427cf41ccea440cf3fb08c520c3a75fc6e345d5546170b20388574f8ab8e2b6af348f98231dfc37b2352d50a0b354a1cf1cea8dd3b367ed8460ea
TLSH
T15731B88571C89901FF7B73B522C8B939B17A9E770B8A1BE94201C76885077ED7EC2C24
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 e1061b87bf7bfdc2887b0ed63c18292563f7c06abb1fe0eec80e58cdea718328
MD5 a11e7e45bf12d88500f83e3dab577919
SHA1 54c6f394451718d92a27d0e62ee3e277015bad64
SHA512 ef9c27cc99d4ad8853d6febe8fba305905d13b6b6a66b6456a442a370e7cde16b2eee81d7d4ad9804b92053279f69c08118256da5c7237eff199532e479323fb
SSDEEP 3072:UY3iiMz47h3b8lVDfL/XOw5iUYGXNNhg1AL:UY3iiMz47h3b8lVDfLPOw5iUYGXNNhgu
TLSH
T1B8F3D7BF5E307612EEBBE07EA8E061894CBFE06F878645D5EC241562D9B4723102C9F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 221KB
SHA256 e350b64e7576826520a73f76b0d1c10f6d32646c7e41671a11e3ebcb3aa1116b
MD5 73d3858fcc1a651209ac1cbbc045e1d2
SHA1 7ff430d12d00c678f8af3c7ed587835e2ed4fe23
SHA512 b03ca31930f10fc29b76d90b0612e9f9c5fbdc6514f7fcda5325d37e71e814c38fad6df172448b43b4e789d784a2b480aff3eb30690ee37373a3828cbc153ab3
SSDEEP 3072:79KK5y38kXHuhUFGSMr+izN4AM0MgXhToLLvhP8F0MmXQe5j5ZQ:oHu0JduR
TLSH
T18C242A1936E672D5E02D437719464D1AC7356EC84A9C309EB4E23E1E22FBF843F54B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 63c0993aede46c7540aa4d0f5bf98620b2457aaedfada91c0419987462d78fd8
MD5 7d5986efcb503ac0e963b90735e0daae
SHA1 dffd9cffec33a85dc9f3cde11dd0809fc9784a99
SHA512 e26453b6b628fa7ebb4b7d05578ba88c436d7c41cdaeb9e7887ecc6d81696ca161b7904179d22476322c3c95a2658ec6fd380f847f80b17e41c91e77820ba0ea
TLSH
T19EE0C628A9C8C2AF20A880AB6930774FDAE7D00CD7CFAC6A0F01D81470CE40C96BC260
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 fcdcdf502ff5e27eec64a3c32c4140e6fa28013aa1f2fed4a84ca45f0f6e7846
MD5 5bbe8125a756e7124b0bb2164eae61e3
SHA1 a9a94412275d4c464b32452a125880fb9e56face
SHA512 13d4131243bb68b345a9e7ce035c91f823fa3f24057fa0c7da27e69f6b38309bbc6d1b6b70e289a20d5b4163f9a3181b2ea00b411e8023d9a434cf5a352eba9f
SSDEEP 384:DVa/SGiVA1ayyIs5h97J7Jy4xViHiasJoVk47NhabexnKSOFl5UIvaH5IXW1p3Id:FhfkSiiGA7zEMTExG
TLSH
T1A482AEF7C3D8C62DC81156F4A7157E1BDE2E0928432C3C66C8D8AE4B93E54B2E251A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 9c04dac141fbf3e9dfbf3dd88203cafb47090b3d5711952642dfc61e50c4779c
MD5 a2fcf2411cca275af3122e99c725507a
SHA1 60e091b447667e41d11d87e6c5535550d5bff496
SHA512 b953f124f2bea5ed3b371f54d205f1d5d41530f621923555c24e105b213ff9de8b6b7128e5d7b688535167696a36ea98f5dee94ceeb7026f4896072de0a9a87a
SSDEEP 384:DtixmGZhOayyIs5h97J7Jy4xViHiasJoVJcnl7NxxnKSOFl5UIz5IJIY7wRRsN+p:8hfktmyzMgExj99tm
TLSH
T17782AEF7C3E8C62DC81556F4A7157E1BDE2E0928432C3C66C8D8BE4B93E54B2E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 2824ee2debfa064c9685e936067727d0480651ed1e676cd2bcf96e4541cd75a3
MD5 e8828b3307ae35eb07183cbdce0b67d0
SHA1 def3919ef6297ea6680aaec9093c307da9939201
SHA512 42e3522944070f45c5e908a432f38945fd1f3e05ec5a66da4a1fd4b02053796df9f4e5164ba6864fa526b6c72eb9a7670d02b29f1169197ff6f8b3b5e96db8c4
SSDEEP 192:DVa/SGiVA1ayyIs5h97J7k474bhab+yxnIzSOFl5M31QkIXADaPvIjEvYfPVNPl:DVa/SGiVA1ayyIs5h97J7k474bhab+yb
TLSH
T1B5329DF7C3D8C62DD81166F497157E2ECE2E1A28432C3C26C8D9BE4B93E5872D25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 7fe9153fae3fab6813c7250e85056f55986f79d2147d1cf4126bb055c6efd77a
MD5 9a6469335690ffd2a2eae65bf0b1b954
SHA1 b53725bacddb6b8262885334e1e3e0b26d726341
SHA512 535cf2c2503742b1ad0c207738faff2c4865932a4c8f030dabaad30182cc6ae4296b0597b3838d10e8a7204288829370cf23e97ac6676ee119e8ba6a259e4d3b
TLSH
T1EB41BBA7957FB41B90395A7F2D00BC0A59BB74350262B8F4DE9B916DF0C6CF30B0285A
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 903ff7a5cc49078a400e678c060bb56583605b0b43d62341dfbe29cfeae75c8a
MD5 85beadace0a56d05af535af9d5326b97
SHA1 fb7857ee1505c81fc87b933a60dcc77c07662920
SHA512 c3a0e19532fd6128aa3c311b845b99445454867ffdf6d210161a50b07b2dfca81d5a897e7b9cd1c28932554d41029d6e3d865d4bf156c16e98f706ff40c15038
TLSH
T1A621EEA791BFF46B503959BF1C047C0A19BBB435026268F4DB9B902DF0C69F70B0289B
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7018df4f1a8d9f2a840f8ce37f2d511046eeadbb9d915ce000b903dc2c9288a3
MD5 b5ed69bb4b5dcb9d64374ea2ea3c560c
SHA1 9900dd6dc509b5af21983ad4b615d9ff238f7e35
SHA512 62821a82fd4858891a232adef7ee69a944efa04e1a4ba7b6826752ff11a642d39d0a753021c736a58dcdd608b18972b07eaf553fea9b2ccc731d30dcdd59df91
SSDEEP 192:5RxkA/kv7JnvAPRp24T799Hsb+WNn3hZG1WMlGeb4z2/qz+tVyIsnAUge:5RxkiAd6XFvwxqWz29e
TLSH
T1C342B62EAD20653B9CDBC219F92277A7E7F61025B1D42E84EBFC8A2C11D79CC2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 ab6d24335427d7fc5efd98589eeecd763e356b87d2eaf62bc4d7f2e38263b97c
MD5 c153b0699e9430c682836ecaae943939
SHA1 953149037e621e90809aad60591e3e8023c81236
SHA512 97af45959beb72dfc3e07191a76a2bbbf37393a53e76e97bbaf381985a6b171f5af46d144c34cf1cc8d3266ff26fa17152b3421105f4746486d5a076c5a508df
SSDEEP 192:eRtcBzkANcRLv7NkkPRpiv1VL3In99HsSb+WN9N3zXkz4jQm4H2MkGeb4z2/qzkY:eRtmzk7d7XRvB9hsrR2W29E
TLSH
T13A52966FA910157B5DDEC229F921B767E3F22029A1D42E94EBFC8B1C11D7ACD2207453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9c39c6e6356ded6313f5f45c2d16ccc200b452450444ab2ba7b17c35085b32a4
MD5 eeb97cb26157ba79ba07cff597620edb
SHA1 9711cf2de71e76a0522066c9a5cd4013065df652
SHA512 bfaa61e8ce6b7ba24983b39b53a2759c4aafe981807b6df0418dc075d858976e30f2be7c58c83a460bc3d03ec8124c7efbd945f753434c7bbbcd50a3464d7b34
SSDEEP 192:5RxkAIJv7JnvAPRp243r99Hsb+WNn3hZXU2MOGeb4z2/qz+tVyIsnAUge:5RxkfJd6Xtvwxm2e29e
TLSH
T10442A62EA910653B5CDBC219F92277A7E7F61025B1D42E84EBFC8A2C11E79CC2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f263f468ec0748a44c5e1afca16dc52ed6c8680b201adadcde00201823d0b731
MD5 7bb7c4ee4dbeb361ea8988ee5b5b49ab
SHA1 3bbddb54f0f23dd583d0fe3d2c7e982bca476ba0
SHA512 52658aed03b46e03f555b453a311df008d4c5b7e72c1ad1444e08c131121a465e613b0c584376b8120e3d346e42734c9cd578244c2d7c28f7c8aa52a37f3ff1a
SSDEEP 192:NRtcBzuANWvv7NmkPRpiv1uLlTtJin99HsSb+WN0xoXVKB5OS4H2MeGeb4z2/qzH:NRtmzupntXJuvB0WV2Q2c2E
TLSH
T18662866FA920157B5DDAC229F911B76BE3F6202AA1D41E84EBFC8B1C11D7ACD2207453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 a9b36af6c6ba4748c96fb8905291af0cfdbb8c796d9d6ffaee712982ac746aad
MD5 828807d40ab7a97d4f4be7d32897c89c
SHA1 0ea40d697fb0c8b8644fc083631d6366ad86f589
SHA512 c9bbd54d0474f688b3ead2234ffacfb38d7966afaed8606dea2179eed73494c7b391248b2ef1d86499cebe8fa71dd61f4560cc8c5d29510ceb83ecded633d215
SSDEEP 192:NRtcBz7ANWCv7NmkPRpiv1uLlTtJin99HsSb+WN0xoXVKB5OS4H2MeGeb4z2/qzH:NRtmz7pOtXJuvB0WV2Q2c2E
TLSH
T19162866FA920157B5DDAC229F911B76BE3F62029A1D41E84EBFC8B1C11D7ACD2207453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 02d9e6edeb5d1214394760142b2561a23ac7b2992abc17a145ff42b420cdfeef
MD5 c55f81e3dbabd633f1804becd1772b17
SHA1 92b1d4c793c80682d26c87368d373f166a27a273
SHA512 73ebadedaa2c440346416e2b0201482ca5484e97d7a74e9006aca3167ab002dbb2609a1debb89404b096ba43d30790fe2e1d7e6df1b3d69b9dd37a8d1953903b
SSDEEP 192:eRtcBhuANnQv7NkkPRpiv1uLlTXn99HsSb+WN3qXkz4Vis4H2M2Geb4z2/qzktVo:eRtmhuEM7XXvBrrX2029E
TLSH
T14662A76FA910157B5DDEC229F911B767E3F21029A1D42E84EBFC8B2C11E7ACC2217453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7ae025b6fd594e60d7afb0dc6ef915ca1496b9cb6fcdc6ecd232eb259e7fc584
MD5 122fc29fad93605584b10936f2ff9518
SHA1 bf35d0f9f6373e9e2821c7c6d9f41a60271936b1
SHA512 72629429193153423daacddf8b8e268786e49e2da2954e90f79ea90334c6908e706fd0d7de885fdbfe794822645b816ccde2652a55692534d18f60674c8012fc
SSDEEP 192:eRtcBhkANEKv7NkkPRpiv1tL37n99HsSb+WN9N3zXkz4+Ny4H2MtGeb4z2/qzktO:eRtmhknG7XEvB9hsz12V29E
TLSH
T11F52A66FA920157B5DDEC229F911B767E3F22029A1D42E94EBFC8B1C11E7ACC2217453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 4a44408a32d303a234ab060d6e79ad0a6c46547a677835fbc308b994c5b6113e
MD5 355092f22d488879b2d17ba20cd1ff84
SHA1 51515d91ad39f2c15bea198648bc9ddc35e02992
SHA512 6d2bfdc6604fff38297401915e8a419b0358620c5b317ce5b3fb4a470ffc485f29bd9e1a23262c2400bbae6409ee2317acc90bc4dc3767799abd8a7c05477717
SSDEEP 192:eRtcBhuANnKv7NkkPRpiv1uLlTXn99HsSb+WN3qXkz4Vis4H2M2Geb4z2/qzktVo:eRtmhuEG7XXvBrrX2029E
TLSH
T16D62A76FA910157B5DEEC229F911B767E3F21029A1D42E94EBFC8B2C11E7ACC2217453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 3531d644244c2edc736d44025391bc7d5da2f12c5ce05894f67a0ca5238a1e88
MD5 42c4ac280c0dd051fc4ee4b0118d09b8
SHA1 f5840bc1c8e437f671680f23e73d5fd6082460fb
SHA512 e70e88085e1dcead21d30cc64a42bb8fa1d30c14635a34a394036e6141d16c31bc0d8b4cbffda700774e6c915d369aa7fcd48c8bd16a43554f1e7f022914cfc9
SSDEEP 192:eRtcBhuANnQv7NkkPRpiv1uLlTXn99HsSb+WN0mqXkz4Vis4H2MPGeb4z2/qzk9A:eRtmhuEM7XXvBZrX292bE
TLSH
T1E962976FA920157B5DEEC229F911B767E3F21029A1D02E84EBFC8B2C11D7ACD2217453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e725958d0b329fe560a73ab43c8843efaae68ee192c1c664ef11b03c15fd89c0
MD5 d9a6c60688e0d835157780de011cfcc6
SHA1 146a71c19e497cc7c7e55ca5358f3cf2f65a78d0
SHA512 badf28a206af78f67507898f578fc272e546d8cf25b73395301144bd676a966099ea4e64f772661f3bc946c402a22507ab0f4e7b7e744a29fadfd91ba238efb3
SSDEEP 192:eRxkApkv7JkAPRp24T799Hsb+WN9N3ekz4G1WM4Geb4z2/qzYtVyIsnAUgE:eRxkYAnXFvw9h1XWW2TE
TLSH
T14642A62EA910653B9DDFC219F9227767E7F22025A1D42E84EBFC8B2C11E79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a7b0313f4233d0d43a03d9ba549012f170a129c743581ce346b612c0eb4764cd
MD5 7a6238334269bc3af02ab1a74188b384
SHA1 251abd6a086b6135de4d7ea443752d2344d694ab
SHA512 d920fa7b6090e60d312c1b3b8289051c8df69995f5b8e7de25fc38eb6c423ae08d096b106d79a27c2f101ec51a53693e0249f1a27385623c2c55defc27d4b9f6
SSDEEP 192:eRxkANckv7NkAPRp2v1UL3ln99HsSb+WN9N3ekz4G104H2MQGeb4z2/qzYtVyIsv:eRxk7AjXVvB9h1Xf2y2TE
TLSH
T1F052A52FA920257B5DDFD229F921B767E3F21029A1D42E94EBF88B1C11E79CC2217453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 91e1a863a765eec363e5a3ff860acabc3eed2004838545f9cf1f177e6670e4bf
MD5 1869dd96cec7a90c642131b042a52d3c
SHA1 172f7b83782bee909af5720c547eb2b7b0e062df
SHA512 041ca9cd2ce60ef0db00d4ba18365d1effa84334e95aef664f317e176434d30704a26879927a63c6ef0aca85d2f8e003011bc7c4457b32c2217365a6cfb673ea
SSDEEP 192:eRtcBhuANnAv7NkkPRpiv1uLlTXn99HsSb+WN3qXkz4Vis4H2M2Geb4z2/qzktVo:eRtmhuEc7XXvBrrX2029E
TLSH
T11662A76FA910157B5DDEC229F911B767E3F21029A1D42E94EBFC8B2C11E79CC2217453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 fd234b4b573cf3bf33a7ee6c10c944b2acc7e36d4cfefcefae8d8da15c8c6124
MD5 b070767212cefcddd641136deca35e91
SHA1 8fdd4edb0dacbd3aebebed38861a1378fd4104db
SHA512 b326b79d7c67c029012be6663705d3f6024cc3d495b6fd6d0909968b72a0fb217db6c3f3e486275d2764a75b6f66f4908edf5606382aa141ffeae37aa5b29839
SSDEEP 192:NRtcBzuANWiv7NmkPRpiv1uLlTtsn99HsSb+WN0mqXVKBtIJzK4H2MMiGeb4z2/Y:NRtmzuputXJevBBTeB2NT2c2E
TLSH
T1C362A76FA920157B5DDBC229F911B76BE3F22029A1D42E84EBFC8B1C11D7ACD2217453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 54b0eea83d0e1a051b4f007a55427a1fed53e624e53da6a57c90836075dd8938
MD5 6560bcac7a7f731129acf32fe41d855d
SHA1 9d1985c5bc722cb20a3b650fcd14a3bf5a1fc2ee
SHA512 cea92d14cd933545a134829c02a2e092324d913b375cf11c0a2794447929eb8028c5fc6b6afb6699435fb0bace921eb275b7818e32d6c9823c0e30ecbb5072a0
SSDEEP 192:e/Q4K6I+7KxkXqK4I40pUZNCgVLHrKHfFKslE8nRXzKD/KB+ErUkKN9MFUxpElbC:GQjH+7KxkXqKf/pUZNCgVLH2HfgslZRu
TLSH
T1DF32C72BA48D9A3F4FA8D50DDC126F4BACA5025776780C2456FB9D0803A5BCE115A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\9b70b14b-fd71-4a4d-a71e-f432190676e5\index-dir\the-real-index
Size 48B
SHA256 aef1edcd31c689e5aad3910518c9462771ca29a76051651b7d9f4829941c3efb
MD5 9a9dc8ae2a7fc860a18942f511fb061d
SHA1 35c3c0a0f64d312dd03251b6916ef00ff37f5f19
SHA512 08f050965aebbf0fc269066944c3acfdbb362e01c0b7d809fdb349f438b3d8f8169e86657240d1518ac71c47b0d9538745fa7e6f22a4432026b3065221fc436c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\9b70b14b-fd71-4a4d-a71e-f432190676e5\index-dir\the-real-index
Size 2KB
SHA256 04671ecc74ccb88b66d0af6b8178ab44745f206a26842f8ee8b6eabcdce30e7e
MD5 a6963b55415d9466c4f1ca069fb978f2
SHA1 a4cdaf82822d81ddc9171abc896979a7da719c40
SHA512 f46056dc49d29c2ac7e118e31c55bac5bf0f8ff66ee79170c5a2a0295986b15511c11afd3138bf1afb3f8d4c003cab2af1146a366dfda2c9579ff43eb0ac0d46
TLSH
T10541748DDC8067DDECB152BA2D5420B597B01D39FC4CC39254A4F5A63403A682B4B6FC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 216B
SHA256 36f44f3273d5709b9efd95df3f13ed08fec64c8b676e727ef4c41c093d4aa1a7
MD5 f14af6b6f79db7166ecc72795be0021b
SHA1 562c0c30bd7f2d9d11d63b1c8bd9ffda82828fe9
SHA512 adf1462c9b1b84b2efc6c693ba343b2bb7e297c3c4091d40511bfaf0ada695e5d115eba19b3c09434cf9ccc939fae9e351ef4b6feee9e099e09baeba9057bd76
TLSH
T109D0A9EA46339986AB20EA897035611E94168C0AD8C8C894AE04B19336B8623C812AB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 ff6e3bc22fae2be26d42d1900b83202f4994cfb39667dca85d2a4897f34d2324
MD5 bd4777de38ccdd1920c964bbfa3dd980
SHA1 23da11363ce1f280a2d617560d724e70db288560
SHA512 9bfebbf36f54f2f57e0476ad9707872b22a7a21b5810150741a08d81469dbf33941c0bb813d8fc98a662b5a8f7ded96312a5050ce08392ff74ba59019a841ea9
TLSH
T1C5C09BE709115AC6CF70D7CD7035A71FE51B454DD4D4CCE47544D54332B5923C8515B5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 ba8f0fedb4bed96ecb2be783c3cce67349737778cf1d1357d549ed1cf635a4b1
MD5 d9ba2809b7306002abb733be92e4df29
SHA1 9fe6a93059b964caf67646c22be504db7acaa14e
SHA512 39503618b5d8103ff2625b99e487cbb1b4dbcbf6e438a8aa0379cfc09858176b94acf9c434c56a85aedbf2118191341d39d566c4591603763654196d89cde43b
TLSH
T16DD0A7DAC5336D85D6A097855035514E90194C49C8C5D8E46540B59330BD722C481575
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 3a96a74f1730fe5e7d20f8f7fba5974b70feb2ccd49fe5ce66b500b0124dd7a2
MD5 c9fc049131755f445fc18b45c034a0c7
SHA1 cb3bb935583bff55936c375f53abf030b11a68d8
SHA512 a8b36c86f601f2307d60f0201dd3836463769de4e0ae6932774e6593d1f084bce836b3cb8aee6d241bc6622ec9d8d52e0e1125acae342b15d46b6b178b5ded97
TLSH
T12EC09BE745115D8ACA74DBC95035A31FE51B454DC4D4CCE47144D64334B5923C8425B5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5aecd2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5aecd2.TMP
Size 137B
SHA256 9d9ca3e28d367af92da33cba15099c38e2a91b229318c50533758e3070561853
MD5 1bc983113351d73216a3dbefb4508dd3
SHA1 978943593a30d7188e19a30ad94abb17603ca7fd
SHA512 064da0c2f4d36b1f09960b50d2eda7adfe5e067c5faae935ea5773fb94d5b4268ea4527e58036f4052e4ddbdbf974da26ea67e49b0e2d4439746c2bd0cfe132e
TLSH
T160C09BE70521598ACB70D6C65035974FE51B4D5DC8C4CCE47145F5433075A23C8455F5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 0872b5eeb2639ff91c3fb7cc965d45c8219f42433edfe9703e4013dd95286f95
MD5 19a937c7a11ee98fa9c00fabf2dca7ff
SHA1 9bb96330d4d8f7df6becd1c371fcce2696251157
SHA512 abc3233d11b74290e1bc25e8aa7edd87fd52116ecdf94640580e7b787451b54fa99b76edea6852eebc97cf6f0d8189df19d01af730d79583a66a698e455c912c
TLSH
T116B0220AC0020002CC20C3F0208230BE3023AFB2E302032AE3E00ACAEC222E00B32C00
MD5 SHA1 SHA512 TLSH

Submit Download

bde75b007ead8c2d_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\bde75b007ead8c2d_0
Size 194KB
SHA256 10f9792d76db0c8ac50908abd6c89bb6ca03d648f783d5a71cf94665e5fb7256
MD5 828c44247ea2f82898435148435f4bd6
SHA1 5b1837b470e2200878664d33adf1e22b09674499
SHA512 f1d582c9c077ffcbb1cb92637308591a84b246834ccf30c48bee8e8e95e1ec63631ffd41f79d6324beceba409466daf9ee9933ac50b52afab6836a9589c0f670
SSDEEP 3072:qegF1cJu9zByRIZa8vj0QbJI1lXrZ1lThh:qegF1cc9zByRIZa8HlI93h
TLSH
T17D146B316300F43BA9139E61A27F7F4E3C35A16BDD0686FCA1E4E870AEE6CB60515758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 0cfb0a3eeadafbcbf7c908d32ff552b0fc3ab0d7a66e913458e7d0852ed55aaa
MD5 cb64ce26d8b232a9d6ed11e2bd89e558
SHA1 031dc8ac04acc1b6e4c45bde2d8bb030427d5a59
SHA512 021b1fafaa39d9eccead2a47bfee65d4d93084c60780a22d400b80441b5e966d2c19cfedffd37299b6fe4011cd5fe517dfc7b04e9a99e52c8ce456e5a5b8ea6d
TLSH
T1AFB0120081C00829C400513135C6043038203D6891CACB9752DC20CDBA1318C1339C50
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 129d878c4b931d7765636c48ad11c4041056075811843ec25158194ba1d32609
MD5 8383911527c9ef991808234812394596
SHA1 9cba5d698e205ce1abd0e94c232c3fbd175cca70
SHA512 d4f884e6a2c0e81e65180c293cf10a57e792d7e5ab388a8b930364c09503022f6b58eb0bd4cb3074a523ba44d694bd51f5073584bf41bff76fe22e148fd32c3f
TLSH
T1CCB022B800C00033C220033220CF00303030BE20238ACF02F0EC022EFC20FAC2222C38
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
Size 316B
SHA256 dc630afdd66595f258ca8a286a3996d389684cd12b407efe5b4e566c1a613555
MD5 cd4cff727f93b50772ec96498eec6e50
SHA1 a574468d8f0236dabe95b6580ee0f4df69195184
SHA512 9df3601750bccb0afb4beeff61a569900c8a6af1b28c731720f82c6791af96c652a3910a72a7d528795e5560ef15a803a09927aa36be85e2e8b3c424a584918e
TLSH
T1EFE0C208BF30561CEDCD133E14417B888740EC5B607344B3D54A0B09AC2FA201FD1EE8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 5634d7d17a06fc8511f29064a0f05214c80d8876408129671b8948490d0a81eb
MD5 64f1cf53dd758ed32e0db92b03a20d71
SHA1 ae626310852f5bfd531ce7f90a1fa5db137182ea
SHA512 139133e4170682f41e35db9c27b5dd11b381330f22bc7f4252046b921b0c44e01fe929b88b7e08e80822b2f3a6c9020f4b234c72eb4bb46bb2f0e2ef77d3793c
TLSH
T1D5E0206625C9C7BF30DA415F5332E30CC5E1B400D6DE14211F09ED4852C7488B3912C1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 3d39e9e0082e9c95eb43fb8d18722b809b277c85dd9103851ee28001aea04595
MD5 6b74f71c5bd58c19f60728aec8d6f1cc
SHA1 7747c1083e20864a586c9fcb5a9db6c0adf46bec
SHA512 59b0eda94eceb80ddea4190231ab5d0f172e4873bfb111aa0514344b76619d81ac3e2988184a6ad12c030d39186970fd425583646135cc0dc11cbf5f66a3b17e
TLSH
T1A8A0022042D70416DE11E774A1616D65735648945655835355E28848E86F1C44583511
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5f14ba.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5f14ba.TMP
Size 48B
SHA256 caecc7a55d3cfce441d28c267368549739cda2b534faa80cc42bde277d4c01d5
MD5 708329659dbac6f0436ac4e0a6ed8755
SHA1 0af1aa06fdf9800ac25b9d36e3f8af9c6329bbbc
SHA512 684b06277ec9ad03f8373ce67be0566766d066446fedd21159a56021907aec3c60edcb58053ee96246338b84519c0e019da6c48a82525be0c3952520c0c2ec74
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5f8565.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5f8565.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log
Size 7KB
SHA256 609c29ed8eea5bb526807789e1b13fa4c058a483848016b71148171246f2c517
MD5 9b9e24fc6c83ad8420f581a6e56e0ee1
SHA1 d010e714dc616a554dc65e1dc3efe1f209ce82b6
SHA512 2e6333ae8bdf86911fcde316f25b77d3195467570b6066cb891cd4649a2c82112ff3196b011ae703f99daf7f014df09553cee501bbce9a816ed3b98095e5afd7
SSDEEP 192:H6cxExq7wLwfxWExLxWxmNJ70BOotpb0hupF1jf2C2ENJ70BOotpb0hupF1jf2Cj:H6cqs7QujFkoNJ70BOotpb0hupF1jfRo
TLSH
T190F1D0B79A00D0A1BE52DDEE286FA12CDE2BD62E4CE8C4F3D184D9B17069B67550F344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 c450fdbdf049c7a566e8187de0dbe7468ea1546dff79705d0b4da435d8dbff27
MD5 2bf1f21e65efe33e346bf107889f65df
SHA1 810f804d6be8057a8c600c32a46c737cb565ae2b
SHA512 4ef1de404253182683cc5776dbe73f230e66a38e8feb2e896b2861b5076d042be3dabeb661e6e19390376b4df095c454acf843251ed00bea7a15b2581a80c4be
TLSH
T1A9E086B626D9C6BE20D6E15747E6A30DC6F0F80497CB79469F09989C61C258873B1A90
MD5 SHA1 SHA512 TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1184_360982546\Shortcuts Menu Icons\0\512.png
Size 4KB
SHA256 d345d2dbe2efd56ff9494cb31cae0e28cde5bdf176a22bca9aee27465b117c88
MD5 97193e4d969021cb6e6ad1b25bb7499a
SHA1 69cb3acd8bc0b31b63791efc9dc47d5657bbf40b
SHA512 1df06713846ea152089ea40434f3fcff250ba2d2c0b5afcbc546b82a65b68f3ad1cf503dbc4e8246765c01f191b4f8389c4c55efb7da507f443d858a8dfd704b
SSDEEP 96:TTcYKfambSQTNpzzBOWUjfRVS/TFm9BfyKhnaBS8ZP9jeLWfbOGp:SbSQTNh9gD+mLfB49ZILWfCW
TLSH
T1B0A1968E8CB5488E66658747D48538A2C5B030A7A7BFC3BE719D174851E32C6FF29B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1184_360982546\Shortcuts Menu Icons\1\512.png
Size 7KB
SHA256 1e0b1b2e4dac49da1e2ce91a72e01f77fdb3bbb26ed3422e5d4037745cc307a4
MD5 cc525d60c0dc9696ddfe9524dc9abe82
SHA1 fc94cbd2a45bf2ff0fbe411f57a7cafa31126bfd
SHA512 09ab42f7dc3d6a08b9635ef229539a5c4c240506378a9de4eccf1f69d52b266222cdf084e9a567c6d21f19e61c4da7ccd98928870d6f10cd74e9158c64a4142e
SSDEEP 192:U3/tgbWgm8Xl2X+xqWwB3kUXPmv9rCywxAQU:2/rgXXExWKdXPa+txrU
TLSH
T159F1AF6F639B59EA3AF8493D4BD7A21FD62E108A2F275B71C5101045628A1C1FC69F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1184_360982546\Shortcuts Menu Icons\2\512.png
Size 9KB
SHA256 ad08077126e7106674e4219f5f9cfac2305e8b3f627247c1d3e72136399e6fd2
MD5 660ae59d489be5b5e1e9036b88b4a033
SHA1 b1ebdb9421bf14b5c43a399b4dbd92288d91a604
SHA512 3bf52f4d1e92ececb7691bedf1f53dea75041615447eac2c1ec9f99d07417a571e08fbd2db58896506350e8af831e8fc943d35e35747a8cb6db9a03d880331f9
SSDEEP 192:uJTyU9sUZdxl59pfNK8EliT9Tjx/t0xM6LwZx4nwBmJH/Rr6O:g9sUxXM8iiJKMfcTJIO
TLSH
T1F022BE9744E4E7A3427CAEBF4684D914DF4E1B7384366E10020B199F0D7AA8268E8B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f85c424b-85be-4d58-9d42-8e27c72be128.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f85c424b-85be-4d58-9d42-8e27c72be128.tmp
Size 414B
SHA256 bd242f63b428eb1a955941b138993da917f1141a9d132d69e6394153a1a09e25
MD5 e659b035884ac294530da0df0ebb5ff1
SHA1 253e51544860877ed2be10f06d27dff869f56e75
SHA512 104d298a47672cb0f7f8b9d5dcfcb1c4f017feedcca45285e54bfeefbd1c7932f5438baa47042f4a6bc04b5794eed2a1cc7cd978f8d75437a224864de494baaa
TLSH
T1EDE022AEC961EC3B0DFE6B5860414746E795132BAB40854F3A3CD30D8FB5A7A4AC5C2C
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 da3279115defe36e241b77985d4abf09b0c4a6f211ae26ab64ff6484c73e7d20
MD5 45f1d4a117a0e6ef9932b908fc1e4f8f
SHA1 dca14290e5807e82b29e1cbc9199b90b98b7051c
SHA512 09f376c72379b319cf4207fff30337b48fd0bff6dc3a17a8a49820c40281d570d0eb992d732af2ec2f5c651528732d538a3bd1dafa79a4f1d47a8b3bc8e790c7
SSDEEP 96:5C0d+CgjAe56y7nKZwpOfsBalSl8h4otop55IDRB6WGyvk5EMZH1Qzb/ZxWlBdAB:5C0Ngjf5ZKSNqiU20nWWc2PHWlBdAUC
TLSH
T167C119B5A46D9D6354F2C295F0032B43CDF610AF9960EF94E9E98B0D00FB49D2382633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 157KB
SHA256 4c5432529086e172852520be77d5ef092a3a3ec16e3b7f06f3f531de09aa1bda
MD5 b0312e7b51dfc52bb3798e2f961bab5e
SHA1 d60a79533dbf9db4de76cd0a46845002463488a7
SHA512 689c0d3a49ec975c45343602dae472c033546f612ae63c64e211dd8f7626cf830f091a140139692f951e7deb8c2ccffc8d30fdc43bbb83ce74a98ed3fa848af1
SSDEEP 3072:TbTooABwi4L6apwVbYb2d9/FGSFJN8aEbzthwKoqCgr46MltcqrK:XTAeicwN9/FGO8aEdhwKoqCVtB2
TLSH
T1D0F312B4CD695CEF4D6C8A00F148A11FCDE64C89D128DA0E45DDFB98D2ABD40BA33D5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 39KB
SHA256 d2fc888bb1a6f213a5a3f880befb9d7eb89e4969bd4bc1c9a847edc439f490ed
MD5 51ec35b6f86b95d4971db0145006541d
SHA1 c7e84da97450bdba4c8d8ebeca279875f0e49c6a
SHA512 c03f2a3b9bcc43ea5e01c30338e21cd1a26dcd2f8f9eb8bffd5dfb6e960926bd370258af2847e5441bc93b6ba857cf10610d54dde365bd7f6681383aa8ed9265
SSDEEP 768:vMgbySQdvwB5o5jKTDBZXGvCnAko+LiGrQF9SznOlopvXEwXlLVU6CB+ZoxE3THS:kSk+BZooABwiG5OyOoL66fo23DU9
TLSH
T18F03E064CC3C9CBB8DB5E852E11D7D47CCB4490AE680EE0D85E89F7D54B794CE263A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 157KB
SHA256 60f75d85ad2efaf2df4caefac47b6b3ae571433940d5b9abd02b4f2d40dca876
MD5 f7cf5fe3322bc99d0549517ab8e74cd5
SHA1 0de1cf05b9d1e7ead26a4187076ac5f90977d811
SHA512 8bd4f24807ebe510dc7416455f90fecaf68ac3a8e90c206244a787abf7534c77df4896c01655537f3b51aef8d09d24189ed801a8882a74e4a5d657ca7e3a3329
SSDEEP 3072:XbTooABwi4L6ap+VbYb2d9/FGSFJN8aEbzthwKoqCgr46MltcqrK:rTAeic+N9/FGO8aEdhwKoqCVtB2
TLSH
T1A4F312B4CD695CEF4D6C8A00F148A11FCDE64C89D128DA0E45DDFB98D2ABD40BA33D5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 74cde0e982c767c5da5b21f195b1f778b648fdd744e718cf956ac9e18a1e170b
MD5 f51bf2898da7b67c4092a4f75d97cc47
SHA1 414477ffef266fa3ae8c339b7a50425c0ac546c0
SHA512 552a23ea709eceeabf23d7b9fdd455b8969da94573b9be6cfc8f1819e34a998ac9f0d3a2f1c60456947618ae6dfad0cba1f51950aaf0b983c7e25cdc0731144b
SSDEEP 96:5C0d+CgjAe56y7nKZwpOfsobajcRDotok554DRB6vGyvk54EBTboRYv4a:5C0Ngjf5ZKSNqDUDYn7qEBTbog
TLSH
T149A12AB1A46D4DB794B6C989B1437B43DEA521ABE961FF84E8DC5F0C00FB1D81382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 33a98344a821a24c5577249227d4f6b6723ce481e8ab0ee6a6f4d51d92afacc7
MD5 80bf92c31fb0cddb95bc4e5425c08f02
SHA1 23b13d9f88f1cae47a333f5e6516666ff7a9a80d
SHA512 09f6c3c0fbfa7bab63dd80111f12fa709e595ffb36973c0461a340716a511723289b510cb1e9ba0f59ecf0fb9f1dc2d5da9fc81a132c9559995142dc59ed9ad3
SSDEEP 96:5bJ0d+CgjAe56y7nKZwpOfsBalSl8h4otop55pPDRB6kGGfvk5EtwlBwRNC39IS0:5t0Ngjf5ZKSNqiU2Xndv3twlBwuCms
TLSH
T1E4C1F8B5E46D4CAB48F6A589B0032943CCA510AFA964BF48F9E98F0C00F74DD2382533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 ae525bdd3e9b08870f3761575fbb96d7baf5456d34f16471857b2a7be07c1c39
MD5 3f567691b6fa8fbdd211a3265f2aacca
SHA1 6f28f2ec22d6d7bd248ee3d59e358afe38afd7d9
SHA512 70e7cc889a18ac8a6b17bdf1c195020a56ce43733aeec92c2d8badf2a6efd2c775a869b320ac9179b9e421fcd3f11844978adbeb1420e74af1e8af5bdc0f5e0d
SSDEEP 96:5bJ0d+CgjAe56y7nKZwpOfsBalSl8h4otop55pPDRB6kGGfvk5EMZH1Qzb/ZxWlq:5t0Ngjf5ZKSNqiU2Xndv3c2PHWlBdAUC
TLSH
T156C108B5A46D9D6354F6D295B0032A43CDF610AF9A60EF94E9E98F0D00F759D2382633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 63c97b9b5e025c9a436664096ec20f3f0ec87350c470d0c2fd10ddb510c94ad3
MD5 2aaf95e4a0be82f909f87025c73fedc9
SHA1 d01c6d9dca403d3d2bd32a7d7744e7e8460f1efd
SHA512 9e45515e26533a200e6c62276e11d6d8360e4b49ae97fed8fd61f86151cb7897886fb4b6fffa163d686e2b962a75019fc0aab5a7b48ae42e5ab755949fbd587d
SSDEEP 96:5bJ0d+CgjAe56y7nKZwpOfsBalSl8h4otok55bDRB6kGGfvk5Et3lBwRNC39ISMz:5t0Ngjf5ZKSNqiUDdndv3t3lBwu8xzxV
TLSH
T152C109B5E46D4DAB48F69589B0032D43CDE510ABA964BF48F9E88F4C00F74DD1382633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 fd97becf942d910a96340d25f115a1c979f90c4571d24e717620613de7d7c16c
MD5 d2ea5e3e7ff1838516fefe0bb712b234
SHA1 4cf2527a9dfa85883f3b6fe4aedd037636c5c7ec
SHA512 6b2259d9a52f46524d64db747a66b3a6df553bbd8b8172462745b60b9d1fdfa37eab06c4066459c8aefffa1caf4040f059a563ce40a4f817b5a0f7305ee16394
SSDEEP 3:MsEllllkEthXllkl2zEgltCYxN/ll:/M/xT02zjYcVll
TLSH
T1A0440205AF824906C5001835D82183A02360D45445115783247584125C896801C40000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 a38256d9d53a9b8c9b538924487130d70a17c6dbab0e57358bbba31f8379f063
MD5 24fcbe9cb8757895cc4b361cf936f8ea
SHA1 06bfcf2fdd5244443eb3aff28db5a16b507f7b9e
SHA512 459241a70575253da50ac4ce7a9cecfc64e47333185fbbe7026d0e375af9b4b4264bfa05a12882477e2d905773bae863bc67f9c8946f30112aed2cfd64e07151
SSDEEP 192:QUcx7MqLIYl7S7raPLcre6zzaPLcTwzREsOUm:QUc1MODWraPwre2aPwTatOUm
TLSH
T12923A49F152468A5F1B6B83DFDF298446C6E5B14CBCF85D8A8E0187324B056B701DFB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7556_245949777\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Roblox Player.lnk

Path C:\Users\Admin\Desktop\Roblox Player.lnk
Size 1KB
SHA256 353d68528de47f1fd00fd0b74908d91ba3e5fb478874643a39627b63aff922c1
MD5 169fffcd8316ba112a0eb0feba48974b
SHA1 9251ebbfdd39c93b5211770aefb68bd7d96f703d
SHA512 6dbd4506a8f911ec4495516167f63e230f19c72ddb60d9d98e6095ebb527896995f0425ed8db89f71127cf16a8247dfb101e525ba0da16a7e3f5f2934c692a12
TLSH
T19521EE184F99173FF5B2953524B56741F7317C027A185E2D80CA23082930304E9E9F7F
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerInstaller.exe

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
Size 13.0MB
SHA256 56dcbecad0ca0cf3d804db152f27d92538af6224d8f56ac9099b993cddba05b4
MD5 ad26a1883623a2c55bcb450e172b9ba9
SHA1 3020d2e5f8fe69459a214012bc4fa3807e0fb833
SHA512 23ad0b62d6fc0bcdb5a836cc45bcef62e698b25b6a49291143bd44ca20db2961f55b196cec7c13a3ba5d16856d763808a644c5f2730da84ce4e387ccfffdc1c3
SSDEEP 196608:Boh4Fgwg1ko1mJX7/m/XB2u/jemMhNpazkwaeKNzB:Bftg1CJX7e/XD/j0pcKFB
TLSH
T1BDD69D6AB2B800E9D4BBD178C6565607E771B41603709BDF17A08ABA1F63BE01F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 831335.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 831335.crdownload
Size 12.0MB
SHA256 4d423ad46d0bf43cd22c9c1b5d25167edc15e784a57e94f889f1eefb5ce238a0
MD5 3240bc150c493952fc0c727f47b96f5b
SHA1 bf3d5f6baca61e27b61d7365bc58df4e8f2f967c
SHA512 61c378817dc3bcdcc5f4c95414f91ec4621e4ec7841de7f6cbaae13b1d653b3fb69b503773c3cd703e886bfd20f4f1369cf9ecef0d405e3894ec513784d147a2
SSDEEP 98304:UYJOvTscod5DkasbMZszos0D3FuOYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrTl:UYJQscgsbMZfs/ObAbN0
TLSH
T11AC67C9533FC2A35E3B74B35A970721A05767C2EA901D78F5B85BA1D2972280CDE0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1488-4940-0x0000016284380000-0x00000162843A0000-memory.dmp

Download

memory/1488-4927-0x00000162843C0000-0x00000162844C0000-memory.dmp

Download

memory/1488-4926-0x0000016281FA0000-0x0000016281FC0000-memory.dmp

Download

memory/1488-4966-0x00000162947C0000-0x00000162947E0000-memory.dmp

Download

memory/1488-4920-0x00000162801E0000-0x00000162802E0000-memory.dmp

Download

memory/6188-5098-0x000000000E2E0000-0x000000000E438000-memory.dmp

Download

memory/6188-5097-0x0000000012020000-0x0000000012E9D000-memory.dmp

Download

memory/9692-5080-0x0000025B4BEB0000-0x0000025B4BFE0000-memory.dmp

Download