536b02fb694b09649cdc6a83b01c3bb7a1f2d980d15b879c0939020fc4d78428

Analysis

user interaction
yes
max time kernel
1050s
max time network
1008s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 13:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Launcher.exe
Size 50KB
Sample260727-q8btrsbc79
SHA256 536b02fb694b09649cdc6a83b01c3bb7a1f2d980d15b879c0939020fc4d78428
MD5 4de2d1a3529526b8dbddee589f03ae2e
SHA1 2db94929f26b45e389ca86dfe7680c8c3815fb5c
SHA512 1249e04750353354223aa01f706fab731cb33ed4b49a4dd843f83c483d5c660c7503cedec4097d3f2ce82f41414ee1b8de0ad1cb1b4e6c880126167fa21e69eb
SSDEEP 384:jJYx0p8ZF0ZUNm4B8dNX2AgPWllD/YSQeeGpbVSi8bDdEZIYU+yOBKi+7Y:Y0KrBcCalDQSQeeWC6eYLzKiF
TLSH
T1C933F8608B0D7808FE012EBA87DBCAEF92F5F4119C6646E8F54531485C71292B5BAF3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
260	332	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
3764	RobloxPlayerInstaller.exe
3204	RobloxPlayerBeta.exe
3012	RobloxPlayerBeta.exe

Loads dropped DLL 2 IoCs

pid	Process
3204	RobloxPlayerBeta.exe
3012	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
177	pastebin.com
178	pastebin.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
163	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
3204	RobloxPlayerBeta.exe
3204	RobloxPlayerBeta.exe
3204	RobloxPlayerBeta.exe
3012	RobloxPlayerBeta.exe
3012	RobloxPlayerBeta.exe
3012	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\sky\cloudsfb.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\sky\noisefb.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\StudioSharedUI\MeatballMenu.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Vehicle\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\XboxController\ButtonY.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\PlatformContent\pc\textures\water\normal_10.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\PurchasePrompt\SingleButton.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\fonts\Guru-Regular.otf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\fonts\Roboto-Italic.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\SelfView\SelfView_icon_mic_disabled.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\PlayerList\StarIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\fonts\BuilderExtended-Bold.otf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\models\AccessoryAdjustment\Ring.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\StudioSharedUI\alert_error.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\PlayStationController\PS5\ButtonTouchpad.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\icons\ic-close-white.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\icons\ic-search-gray.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\chatBubble_white_notify_bkg.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\CloseButton_dn.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\FaceControlsEditor\checkbox_unchecked.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\icon_star-16.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\XboxController\Thumbstick2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Emotes\Large\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_6.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\localizationTargetEnglish.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Camera\CameraToast9Slice.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Moments\Reactions\skull-large.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\VR\Radial\SliceBackground.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\AvatarEditorImages\circle_gray4.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Chat\ChatDown.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\AvatarEditorImages\CircleCutoutLarge.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\btn_redGlow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\VoiceChat\SpeakerDark\Unmuted0.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\VR\Radial\SliceActive.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Lobby\Buttons\scroll_button.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\NetworkPause\no [email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\9-slice\chat-bubble-self-tip.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\content\configs\InExperiencePatchConfig\InExperiencePatchConfig.json	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lua.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
332	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296341524662288"	chrome.exe

Modifies registry class 36 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-ed2b47b81f08484a"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-ed2b47b81f08484a\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-ed2b47b81f08484a\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-ed2b47b81f08484a\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-14d8b191232f4ddd"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-ed2b47b81f08484a\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-ed2b47b81f08484a"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
3756	chrome.exe
3756	chrome.exe
3764	RobloxPlayerInstaller.exe
3764	RobloxPlayerInstaller.exe
3204	RobloxPlayerBeta.exe
3012	RobloxPlayerBeta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4972	Launcher.exe
4972	Launcher.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2836	1756	chrome.exe	91
PID 1756 wrote to memory of 332	1756	chrome.exe	93
PID 1756 wrote to memory of 4916	1756	chrome.exe	94
PID 1756 wrote to memory of 4916	1756	chrome.exe	94
PID 1756 wrote to memory of 1764	1756	chrome.exe	95
PID 1756 wrote to memory of 1764	1756	chrome.exe	95
PID 1756 wrote to memory of 4236	1756	chrome.exe	96
PID 1756 wrote to memory of 5040	1756	chrome.exe	97
PID 1756 wrote to memory of 4236	1756	chrome.exe	96
PID 1756 wrote to memory of 5040	1756	chrome.exe	97
PID 1756 wrote to memory of 1008	1756	chrome.exe	100
PID 1756 wrote to memory of 1008	1756	chrome.exe	100
PID 1756 wrote to memory of 2936	1756	chrome.exe	101
PID 1756 wrote to memory of 2936	1756	chrome.exe	101
PID 1756 wrote to memory of 4408	1756	chrome.exe	104
PID 1756 wrote to memory of 3680	1756	chrome.exe	105
PID 1756 wrote to memory of 3680	1756	chrome.exe	105
PID 1756 wrote to memory of 2564	1756	chrome.exe	107
PID 1756 wrote to memory of 2564	1756	chrome.exe	107
PID 1756 wrote to memory of 3440	1756	chrome.exe	108
PID 1756 wrote to memory of 3440	1756	chrome.exe	108
PID 1756 wrote to memory of 1036	1756	chrome.exe	109
PID 1756 wrote to memory of 2684	1756	chrome.exe	110
PID 1756 wrote to memory of 1036	1756	chrome.exe	109
PID 1756 wrote to memory of 2684	1756	chrome.exe	110
PID 1756 wrote to memory of 3368	1756	chrome.exe	111
PID 1756 wrote to memory of 3368	1756	chrome.exe	111
PID 1756 wrote to memory of 452	1756	chrome.exe	116
PID 1756 wrote to memory of 452	1756	chrome.exe	116
PID 1756 wrote to memory of 1444	1756	chrome.exe	117
PID 1756 wrote to memory of 1444	1756	chrome.exe	117
PID 1756 wrote to memory of 4468	1756	chrome.exe	120
PID 1756 wrote to memory of 4468	1756	chrome.exe	120
PID 1756 wrote to memory of 3084	1756	chrome.exe	121
PID 1756 wrote to memory of 1652	1756	chrome.exe	122
PID 1756 wrote to memory of 3864	1756	chrome.exe	123
PID 1756 wrote to memory of 1728	1756	chrome.exe	124
PID 1756 wrote to memory of 1728	1756	chrome.exe	124
PID 1756 wrote to memory of 5068	1756	chrome.exe	127
PID 1756 wrote to memory of 5068	1756	chrome.exe	127
PID 1756 wrote to memory of 3364	1756	chrome.exe	129
PID 1756 wrote to memory of 3364	1756	chrome.exe	129
PID 1756 wrote to memory of 4464	1756	chrome.exe	130
PID 1756 wrote to memory of 5112	1756	chrome.exe	131
PID 4972 wrote to memory of 2332	4972	Launcher.exe	137
PID 1756 wrote to memory of 3756	1756	chrome.exe	141
PID 1756 wrote to memory of 4644	1756	chrome.exe	143
PID 1756 wrote to memory of 4644	1756	chrome.exe	143
PID 1756 wrote to memory of 2352	1756	chrome.exe	144
PID 1756 wrote to memory of 2352	1756	chrome.exe	144
PID 1756 wrote to memory of 3652	1756	chrome.exe	145
PID 1756 wrote to memory of 3652	1756	chrome.exe	145
PID 1756 wrote to memory of 3236	1756	chrome.exe	146
PID 1756 wrote to memory of 3764	1756	chrome.exe	147
PID 1756 wrote to memory of 2268	1756	chrome.exe	150
PID 1756 wrote to memory of 2268	1756	chrome.exe	150
PID 1756 wrote to memory of 3544	1756	chrome.exe	151
PID 3764 wrote to memory of 3204	3764	RobloxPlayerInstaller.exe	153
PID 1756 wrote to memory of 4200	1756	chrome.exe	155
PID 1756 wrote to memory of 4200	1756	chrome.exe	155

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa8529c728,0x7ffa8529c734,0x7ffa8529c740
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1944,i,18385281260045951823,4627015362699156853,524288 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,5103578303826731133,16600950114326037526,262144 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,9056506661025564752,3843013318245208848,524288 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,12840588708210762828,16664947695074695554,2097152 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,17032565445440258135,6533744346033520558,2097152 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4584,i,17557493312513233148,4542388036813770372,2097152 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4720,i,18189435078512124591,8112243587128378178,524288 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,14885168683723757821,15793307446224149232,524288 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,11930405512577096126,6260910152766545672,524288 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,10521910332408705134,13586017508702105532,524288 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,5186165618556535298,12032059458760845839,524288 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5388,i,3468150704886209712,1445775002337178145,2097152 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5852,i,14225789597783705545,11728963454766519802,2097152 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5456 /prefetch:2
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4616,i,1190180472082059433,6202695099709097755,2097152 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3476,i,8295932725218920620,9387726452057975414,2097152 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3416,i,10296813398581613892,13691262574289624977,2097152 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6020,i,3372511406472202267,8266516897617085063,2097152 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6184,i,8318583442251555864,4833730380545573529,524288 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,8396331005533806985,13535016324753842577,524288 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6180,i,8878011412637150134,15763383851200438802,524288 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6416,i,3415950723623854101,5800118869057164679,2097152 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6028,i,8173050736881229767,1885106719252071621,2097152 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5528,i,15378548600029155719,16263691186047056374,2097152 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6484,i,12232351588449637331,4322686101418608329,524288 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,10509023787534573160,3486811256416346632,524288 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6136,i,11833591690468876671,2960631015633708574,262144 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6592,i,15197306711244953691,7829973126585340022,2097152 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5052,i,18123045413963076866,2473112105495611575,524288 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=864,i,13581077320490708625,3216565058656361279,2097152 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7200,i,8825675357324328650,206597110990709879,524288 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7116 /prefetch:8
  2⤵
  PID:3236
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 3764
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6828,i,10266898663410579854,17273846126999476619,2097152 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7052 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7136,i,8310377073838903964,10576503925953430733,524288 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3364 /prefetch:8
  2⤵
  PID:3544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1140,i,6102326426171077840,14848966643715705092,524288 --field-trial-handle=2116,i,2046384701786937614,82159995399103292,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:8
  2⤵
  PID:4200

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:792

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2684

C:\Users\Admin\AppData\Local\Temp\Temp1_Software.zip\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Software.zip\Launcher.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:776

C:\Users\Admin\Downloads\Software\Launcher.exe
"C:\Users\Admin\Downloads\Software\Launcher.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\Downloads\Software\bin\lua.exe
  "bin\\lua.exe" "cfg\\user-data.lua"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2332

C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.7MB
SHA256 0bf6d10b71b025e36af8802335cfcf5a693cb351731e6d3f56c9a9616ab2c4c9
MD5 6a2df518995fce2ec395becd750fbb69
SHA1 8f40283d158a0db74743755bc6e356f3de4f0e21
SHA512 ff1c2fe1cb904a2cb0846b3e314e4f2c02aa2945b389bd94f1ac7bb7d66058d222970c7334a577430c1f2498908f50d077560c0b032bfc12958179dc3c4b8e88
SSDEEP 196608:Lqrajgrui7KiWARoWQb5amsxUMRUFUnvTBDbBQ03O:Lm77KWiamsxbU2nvTBiQO
TLSH
T1D8A6BF22BA00C032E8D100B296BD5FFA997D5A341B3954D7A7D41DBD5A306D33B3AB1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files (x86)\Roblox\Versions\version-ed2b47b81f08484a\RobloxPlayerBeta.dll
Size 20.9MB
SHA256 a5e1cf709a64dd3922e3d81562524bccebb9762e1c693e97f09f65ba88be6f52
MD5 be3ef08989567375607175b90e935dd9
SHA1 a9672e47fb68dbeafd8fdb1eb2f684616e412b8c
SHA512 c3838706c2493c4ebc70d8b7ca89104f1cadb146f1369fa818877461f1fb4f3e15f2adf874371aa64ee1acd06e90334f1292e3c2cd71bb3e2860cd67f777ccbb
SSDEEP 196608:uCF8Xlf9MbJSbb8p+jq5OhtPz0aXmgwCDpsyN:R+XbKJSbb8sz0aXjDpsk
TLSH
T19D27C04EF4D21AE8C0A25078E65F57E3DA32304C4A687EF787D90250363268D6659FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 17f681aca388468cdb6a8bb8bd2bac93c139710295c8ec8063e9055916607f99
MD5 7056b0fa56d17a097a90fdc44c55be78
SHA1 c50a35e41aa90c56667f4bd483a10627b135b4a4
SHA512 0e5bdde2277e87165b8b7e3292e058c88ecb9deeafdda170291689cd41d58834013366b9df9b83b15e050c09605a9ee26c59d9fa951e97674a7316b8b5e94d8c
TLSH
T151E02BBAC8A1EC2B18FE576860514749F610135B2650494F7A3C890C8FF0B7A5A45C1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c
Size 7.7MB
SHA256 c9b968b8960cb1a7a74fa563e2cce3d3e79f77ec416a760820b90d749c46218e
MD5 9046a37d6ea1af9d21aefbcd76340f9f
SHA1 4dbed31c9058be322f6f140287882c8e58b2faa5
SHA512 7e449ac066496772e094f22156add7f7b1462f522e376753d8dd162b1e6488d618a2a0110c06f2354f7a347e7b44e1733e3a5a8097342e7229e121e6e3b3f696
SSDEEP 196608:pxXebNAb6Can7uUHzM5uh9d8uucQramSADLSc+:XObKbHYuj5uhkuy3SAP4
TLSH
T19286334CF37BA508E61F933A318F006AF6548F15EDE96B1B039C21291DAA4D71F63396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 624B
SHA256 f22c1620ffa3da512bebb018157e2192cdbf809ea55726ea3628d665b34b5d59
MD5 7cd9e699eb88a3b4bed2ab8661f057fb
SHA1 d5e28b8469be118c3111e5f63b1fd5c3fde48165
SHA512 dc84001d46816bb3776b1dc560ab0e6b16afce278f74cc512c0f643522e96e87a17fd92cc43cbdff78d2f244f17a38697a5ebc4c821854eae241c43727c170ce
TLSH
T184F05C421257E660EFA81478638F0B194C1F09ED883E338785B0D59A768F2DC6C3814E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 334ba020d4b60413cbd449129ded126b2839fa94c19ad08c9d7d36a6be9a6ad7
MD5 4947c001c9de10f1d85d43a9e28dd98e
SHA1 5876cb102f890e2db5ae01bc81eda253c413cc5f
SHA512 e7f8dbf130f4ae13d7cc3cc44e6d1b802e9d2600dcd1211ed20f55147e2556796017081f041ae8c2aed83f45b35ed7b0798f3de524494c124cf3c6275f750c32
TLSH
T17E71C71098EFE4E0CF651BB04E8B2F21489CC6BDC51A978B1844942EE3FF1E8997256C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 0b35c6e1c6c59cf3ab2819dec9da2380f74f729707fcc8a141eb18c805e7892b
MD5 987f60a34fc988931ec47b42630ee4c1
SHA1 99c401b5f7e27161c85ac4345cf9419f698ca5ca
SHA512 dde201c4daa6e71526207838dde9ae6c8da4acfd553b8070fb6808a5b0d22f77d191e9eaa9dce4c7b56ba160863a0f29cb41dee97c9319e150c4a9501239c30e
SSDEEP 192:DT0uitquwIauJa+IW+iRIaTEdcEIAfPi1stwiS2kjIDI9I2RNPJaP5vqNMA5gf8I:DT0uitquwIauJafTiRIaTEdcEIAfq1sf
TLSH
T1B64278F7C3E5C62D9A1156F4EB15AE1FCE290628032C387684D4BE1B93E2872E21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 6b93573a318fc874df597440a0dc823e70c14fd18cbc6bbb5c399eef6032b309
MD5 cafcd6a9c9968d76d5dbda469fa2889c
SHA1 0f04a7e235a73c5a5ab9c2fe3685d3af83f60460
SHA512 9e20bb5c2a0d3dbe3b29d4dffdf40f6005e7e216212e853e68af3d24992b4e959a56fb03408a1d8e0b3dd4e6b7555cb0ad7502432fc38f87c6f65de9eb4c862d
SSDEEP 192:Dj3Ys7MTNIaTKS2p8RvEXI4NPJaPuIAfPKNoH3v6thmtjyK:Dj3Ys7MTNIaTKS2p8RvEXI4NRa2IAfik
TLSH
T1F6F1ACF7C3D9C62D895156F4EB156F1FCE290A28432C3C66C8D8AE1B93E2872D21574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 cea7f38ce02b99c5c839c4e098d95733bbc845ef68dfc66fcb4c5271c495e90f
MD5 bb82b9f19af7dd8e51e8593d149dc12e
SHA1 37ae1ab6cdb78c79f4d18fc21b1e7ee1eaf63cc9
SHA512 f9c2160f13b18fb1e427f79b2feb5ef172a4ff8acdace783c6150e02c7c276f3c1566dbb67ac9ce5a896c5a643250552fc6ccaa97a4f73584cc8158ba20125ed
SSDEEP 192:DT0uitquwNj5JT/IJ+E3IaTEdcEIAfPi1stwuS2kdIMmNPJaP5vqNMA5gf8XuGQi:DT0uitquwNj5JTQcE3IaTEdcEIAfq1sz
TLSH
T1AC3297F783E5C62D9A0196F4EB15AF1FCE290524032C38B6C8D4BE1793E2472E20579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 c8971284ea330577c1a74044b49f6edeaebcfc6b4ca6fc1d9c9ae3a667247068
MD5 b7daf0b1a863d6471b2de35269cca23b
SHA1 2570ff0e5848031726f0d0c2bc0360af1f317533
SHA512 29ca4b4061592143af7fbb9d469a716003aeae21a07697cf2ed6704ca3773741f9a2c0b9a7a6d837cb59c8c3fc4544557b991802c3589f06b7773012189725c6
SSDEEP 384:Dj3Ys7MT1IauJafTiRIaTKScEIAfqoHstwid2FjIDI9IjRNRahRNMA5gf8XujmHT:nmk+sOHMsG
TLSH
T13842AAF7C3E5C62D894256F4EB15AF1BCE290A28032C3876C4D4BE1B93E2871E21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 849f912376b2b803c7bd148bc729096e93f74dc49c2c4a6590bcf799ebf48886
MD5 4d4391429e5721a13e33f02db2ddbd2a
SHA1 e9a5e68bc3dfd5f9f14a2e0076fb8d261851b3d1
SHA512 6508d2f7aff3cfec51d35213a951de4d4e79b9311e11f89a9e6617aff99954920ff0eacc34cc317994f5dc39b71bfdad491db4b951be36df0fb82fd995459b89
SSDEEP 192:Dj3Ys7MT1IauJa+IWWIaTKScEIAfPioHsthmtjN/Tlid2FjIDI9IjRNPJaP5vZNA:Dj3Ys7MT1IauJafnIaTKScEIAfqoHstD
TLSH
T1AF429AF7C3E5C62D994156F4EB15AF1BCE290A28032C3876C4D8BE1B93E2871E21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 0e8cecf0c3fce678678f4a5af2c7775e837c6d3e7e26a9c6192060d52bd86abe
MD5 5b4d738160cf9558cdbfc2cca3826e6b
SHA1 0bed51b5d7da0ff36ea5cd396cb8679efffe1ecb
SHA512 2c3a79f10b6069b009f84298a178bc9a263a97c8424b948f2ca1afab0493057f21ddf5e74e659233915d1f103f9f23ed6800bc351bc2829746425ff4351a538c
SSDEEP 192:DT0uitquNj5JT/IJ+EjfIaTEdcEIAfPi1stwuS2kdIMmNPJaP5vqNMA5gf8XuGQy:DT0uitquNj5JTQcEjfIaTEdcEIAfq1s/
TLSH
T1883298F783E5C62D9A1156F4EB15AF1FCE290524032C38B6C8D4BE1793E2472E21579E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 f4426b3ce1320652b8762c295b0369f034f8a1e4d5eea3d19558fbcaa3d2666a
MD5 00c6663488a50fa2fc3d35d2561df1b9
SHA1 a30ef27eab005bc9459d591aa9052e95c9232ad1
SHA512 fdc924bf31fcca4221da1ff3ebce2ef5b94ea9912f10edc4167ed6968331a3fa84fea94607b68888102d3176235cb0774702cb12dc3b59552a22bdb252e81009
TLSH
T1E951CEABC57FB05B606849BB1D44BC0A5EB9A43542C26CF4CF96817DF082DF30B19427
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a52f963f09f44fdcde9935057a57b8b8374ae1fbabbeef34058cefb5b73bda7c
MD5 37059926bb575db3c37091585719a2dc
SHA1 16c4a65b4df95f7fc47cdbf2a9ddb79640fdf773
SHA512 5d6e26c7c5c40ccbe6715855c153501dd1e81e4fadb61b28437bf751dc297c83e992fce6c840a8b3bd2bbb129b061fe7c9e1406bb5f2ce0b3cbdcd3b03ff4050
SSDEEP 192:XR3cBz3Hsfv72HAPRp2+RM9THsb+WNnUK4jv2Ma22i5dkwXfVyIsnAUge:XR3mz3M3CCX6Fw/62z22i5dJe
TLSH
T1A642C76FAD24653B5CDBD21AF9617B1BE7F51031A6D41E84E6FC892C14E79CC222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b4b160cf055bdf132e5d1a84cc181b2e2cf295648bf2d61757734784e9a83077
MD5 8e1491b3d281c9ac34160beea17d266e
SHA1 e26aa45c1e54f8b53f2941f90f821bb7bc937160
SHA512 c22e6b0269cdffc1d4102c344a23b20dce0dd36fea3eaf922d1070683bba267a4a8edeb12b6d9419c1cedb396bc27713a4af13e12bf2841e2f246c1299cf9230
SSDEEP 192:XR3cBzlHsfv72HAPRp2+Rqglg9THsb+WNBqjBL1T1UK4jv2Xl30a22i5dkwXkVyN:XR3mzlM3CCXYFwYd5TR62Xl3r22i5dwE
TLSH
T17152C96FAD14153B5CDAD216F921771FE7F62025A6D41E84E6FCCA2C14E39CD222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 843d4e416cb4f7dffb89f33822ace8e86df9f2c60dbfb4a60a3efac3ed70ab43
MD5 f2c6faea56893cdaee0543200faf6000
SHA1 6b25c97efa8e2e56967da65cf56729a8c968499c
SHA512 e0ca8b5950711aa492b33ac5cf2abea546fe5d9836ed004b867b27b1c9fc3b389d24ecbfb83399978d7f45e6ba9d5202c84654fc09ad0e38026930e10aa913e3
SSDEEP 192:XR3cBzlHsfv72HfPRpH+Rqglg9THsb+WNBqjBL1T1UK4jv2Xf3Ta22i5dkwXoVyN:XR3mzlM3CXXZFwYd5TR62Xf3+22i5d8E
TLSH
T10752C96FAD14193B5CDAD216F9517B5FE7F62025A6D01E84E6FCCA2C14E3ACD222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 71d9303cb5b1cd10db53dada7274c25659d1c410e686149d9bf3142beef89a7c
MD5 56343e4d21b763f070c6f75eedca29d9
SHA1 186a3f52334a1f804af6aeb00ff752075dff415e
SHA512 97314d70b3b61547fd01762f39e8f4536de893affeeb21c98049b9aa56bc6a40746137361c06444d1175e036a041a8055e329136b105e3da86b58bf7e37c4459
SSDEEP 192:XRucBzlHsfv72HfPRpH+Rqglg9THsb+WNBqjBL1T1UK4jv2Xf3Ta22i5dkwXoVyN:XRumzlM3CXXZFwYd5TR62Xf3+22i5d8E
TLSH
T1DB52C96FAD14193B5CDAD216F9517B5FE7F62025A6D01E84E6FCCA2C14E3ACD222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 cbc70d9900482e28c207e590537dfb3847fb4d57b8e8baac9fa5b3284ccbf5e0
MD5 ee545574e14691536005f1e21065a3bd
SHA1 c0217403422aea73b31aa54a5b3317aaadbc9551
SHA512 ec46b60505ecd17ef9f300d5da885051bafb02ae0795edb44e11159dc818f579e7a4f694ceb4c6eb0a7abb6e011020964d986465648a87269f6e2349e6acf546
SSDEEP 192:XRucBzf75fpv72gfPRpH+cjpglg9THsb+WNwK/6KtUKvfg+aPjan213Ta22i5dkc:XRumzf9fpCYXXFw55gvA213+22i5d8E
TLSH
T1F462C86FAD2019775CDAD216F951772FE7F22066A6D01E84E6FCCA2C24D79CD222340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 92d439d972971ced7a82801d11482a252f3cbb9dba12739a3719fa752c35219c
MD5 10362df09f87ac9d17e13e9f76896638
SHA1 7ce16c4b2fdaec9e6297183f2369edd9205a878f
SHA512 e9146dc604c5a96ce5a325d7131c75feb2424ef868fed134c9bb27d62ea46ee5351bb729395d8d4edd73c57a0ca416cb48aaf558ce151a7a73ade6ea7611078b
SSDEEP 192:XR3cBzlH6fv72HfPRpH+cjLglg9THsb+WNwk6KtUK4aPWW3Ta22i5dkwXoVyIsnv:XR3mzla3CXXVFwz5dWW3+22i5d8E
TLSH
T19852C86FAD10197B5CDAD216F961772FE7F52026A6D01E84E6FC8A2C15E39CD222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 8438bd38ac86f712f3a687edbf966f6cbec28156170ffae08ccc27c8199c26c7
MD5 697ffc779a7f7150039dd65c48d38696
SHA1 430cc8bd17d77e0e14f04c5424a769e3b90052a3
SHA512 eaaa6251b6993759d53d9200dba0bd9ed84d73e528742181c2087cf3169fcb907b68311239058909367f3baa2e2ccb525217377519f91839e72b8c0706d856ba
SSDEEP 192:XR3cBz0H5fv72HfPRpH+cjpglg9THsb+WNwk6KtUK4aPjan2u3Ta22i5dkwXoVyN:XR3mz0Z3CXXXFwz5dA2u3+22i5d8E
TLSH
T16C62D86FAD1419775CDAD216F961776FE7F22026A6D01E84E6FCCA2C14E39CD222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 94e103d5f19647c1388d169afaed0f4180719dd6571b99fbfb4713e253a4c211
MD5 fa7c3b28394a0adfac4f6ce698678a4c
SHA1 6b925123b746c282f37d048c849d036e6d4c887c
SHA512 e3feb973892f95380efba359c4ba36287e0915525af2531ff003fc82903d597f8bf32ca8704a9717c6f4fa0ba5eef12bb274e82d3b989ddf094537c6e6321558
SSDEEP 192:XR3cBz0H5fv72gfPRpH+cjpglg9THsb+WNwK/6KtUK4aPjan2u3Ta22i5dkwXoVo:XR3mz0Z3CYXXFw55dA2u3+22i5d8E
TLSH
T13162D96FAD2019775CDAD216F911776FE7F22026A6D01E84E6FCCA2C15D39CD222340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 e8a8910b1064210a19dd16374a02955f6ceb8a9659c7564ea4c084d7ae4f3b9e
MD5 ce15f0b516a76c5a03d03434bcb1508d
SHA1 6b9799e17892ed123869615e6da2b6bfbcb6a5dc
SHA512 742b779d0018e53151ce77f7503ce5de3d3faae9997e15e587349707a8c906065c301a7fe35412b4857215430d5f25547c152605e8d05d4fc39ced92e5314343
SSDEEP 192:XRucBzfH5fpv72gfPRpH+cjpglg9THsb+WNwK/6KtUKvfg+aPjan213Ta22i5dkc:XRumzfZfpCYXXFw55gvA213+22i5d8E
TLSH
T19862C96FAD2019775CDAD216F951772FE7F22066A5D01E84E6FCCA2C24D79CD222340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 a342e5be50b73b9fdfa8e4393352a7f9f8f9fbd2926b2127b8bd631c9b872e7f
MD5 60a16b713049508b562eea5b48b66eb5
SHA1 b2c9c5ecc149ac18d5b194b9554c593085455f80
SHA512 08cdbf3b0041508f2321459e050974eba53dc3a33d1b89d77993179e9b6f12e66aed30191b682313644be6d8a55e5cc55d6ca0da0846a78be41140d0634be362
SSDEEP 384:/1jbW7KxkXqKf/pUZNCgVLH2HfgslqcXODby+ErU3WsHGwIB3WhmxaKoU9:/lbW7KxkXqKf/pUZNCgVLH2HfgsMOOH8
TLSH
T16D52E867688D963F0FD8D68CDC167F4FADB2015666640C2896FA9C08039A7CB115A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 3d3ec56854cae1127c8c38d0fbed456c0b30da16561c58b44ab76112a4512e98
MD5 c292e560fc1c3f77854d6da133cd68dd
SHA1 166d882237716426938bae7076a064e605bf0300
SHA512 33ada173de3dd092fea5063783e6f5f67021c4a949f430344f22f54d36ded671793ddba4ee16058bfe7e9eda12161e58af38d2f44524c073e9212c1b3c0a922a
TLSH
T12BA002E019929025C1DC02B552C619517325495002D15B1E41D548598861681C2B6904
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 a2fda2cfe5d4d70b8edda2a4c3e1b382c6f2e895d775fcb8e8ec374245798570
MD5 0fa7e56fb7e44484f173eadf02200bd5
SHA1 f32fa1967428fc4522f6b5725a132e3044aa0aa9
SHA512 76a41ca55bc12b155c937241407f281fe8bb2ff7e89823d06e28335b79b8e71a395d38bdb9875ae6609ef5eb95b4c4917eb06ca4b89e43c057a986a02de62dda
TLSH
T11EA00220A5C75D91CD4442B5627307466252892A55D7874BA4D35449A85F2E4D21152D
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 158e176d72aebfc2c7a66eed777b759b0f11317a2749c14223adbde449166eab
MD5 498f62dd14e3c7b66426c9c8ebcdba80
SHA1 5f17f132f839a5133805e819f24578f7b4c74065
SHA512 9b73461f1093f3e442616f9ac3e71f2057b0018bb7360d96b1b170d4af482da150c682a4225a238d5910f8284d47fd0d566af7ad5702ed6211879000499d2994
SSDEEP 6144:h6BUb9VgUEcb4/MsIT+CvZBYm7Rkm1tYpBeh2BAo3:5b9VgJ/OTZB79oBGcAo3
TLSH
T1123412325C21BC7714FD932FF08E1E2F2FF1CAB689D0999689D69B0027A9BD11645970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 6a0e30b3adc499e34125bf55bb07d32b1ec101e585ccbafd5d346e673a07d516
MD5 366b5dae5ef89dfa7bdef6da88341121
SHA1 0142d2b57b85b57fa7df729422270c69fe546ea9
SHA512 511d43d79a615365ae634d162a37a5a2f18cd310873b7468e35c6799d295068f2f1fb258f1e9beb1703fa09bb2b08e8d4e40de55e45accfe0e1eebec1e652287
SSDEEP 6144:+LBUb9VgUEcb4/MsIT+CvZBYm7Rkm1tYpBeh2BAo3:9b9VgJ/OTZB79oBGcAo3
TLSH
T14A3412325C31AC7714FDA32FF08E1A2F2EF1DAB789D0995689DA9B0023ED6D16605970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 4f8721e163f656507e453772b8f3139a1fb64da2f086c26e4978c0102b2a63d7
MD5 99491eeff37bdcd64b2a1d70d02a5fc2
SHA1 ad3d94bfc584a4fd846d0f714f07d6fadff7cf13
SHA512 f5e15326fca9619af9c08357b7fa6f30e58e9e24b34f6e0fbc1a57ff58d53d41dd0a2dbd8d1efa2e956079bfa7ca7a5b0e9117f424335522d5028627fa5982c9
SSDEEP 3072:IGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:jm7Rkm1tYpBeh2BAom
TLSH
T1FCC3123B5E71E9775979BB4EB08E0B1F1EF14AA2C930DA42C8D85A0437FA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 908683763c9ef1a11b48f99c916285e062a87f1ba57b5fd5cd7c43d217f5ebf8
MD5 277c11f39e391a0f8fea5d0682e16aad
SHA1 a0f92813c8ae3c9a46318cefa60ff229df2d5d63
SHA512 96bb5f3929198986570ff4cb9e547672dc159aef2b49cbf73ec2bb9a6da7c4577d40a2a768c36df870d2e0aa2c30f77f0c2097290f16e6514f6890abdf333d18
SSDEEP 6144:r6BUb9VgUEcb4/MsIT+CvZBYm7Rkm1tYpBeh2BAo3:Lb9VgJ/OTZB79oBGcAo3
TLSH
T1123412325C21BC7714FD932FF08E1E2F2FF1CAB689D0999689D69B0027E9BD21645970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 bef755d653513a949c3d59be62b8ebc85315a00fa7ecf201901ff0ad55388b5b
MD5 5028ebaf38a6d82fea753752866c5d8d
SHA1 8f5bbaefe86f6a56428c83aa537947706803c57c
SHA512 b563510ecebf1584dd4cc3e226207c484632add4945700d66e6a30f5006212ada72086cffd3f0df338b69f3340b233dfeb4ff803deb623e1dbbdaa5087cabbc0
SSDEEP 6144:xLBUb9VgUEcb4/MsIT+CvZBYm7Rkm1tYpBeh2BAo3:Eb9VgJ/OTZB79oBGcAo3
TLSH
T1F93412325C31AC7714FDA32FF08E1A2F2EF1DAB789D0995689DA9B0023ED6D16605970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 11cb93ce54ac604300a75ea748336b454124bcd339719e43a589b7d1d387943e
MD5 7b37ef3dcc459432fdb44f87bd0e086f
SHA1 f962cc9263b7462294820e4ff01f83f827fb8151
SHA512 632b63e7fbf6f53bde32fdc35204824e04cb4254195be29e3d792d4878be22b67d2508c3b5aaeadf5d9b793b170fbb689160bd797eb987db22cf7523f2c6142f
SSDEEP 6144:xLBUb9VgUEcb4/MsIT+CvZBYm7Rkm1tYpBeh2BAo3:Eb9VgJ/OTZB79oBGcAo3
TLSH
T1A43412325C31AC7714FD932FF08E1A2F2EF1DBB789D0995689DA9B0023ED6D16605970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42167b85-8ec7-469e-8517-07c138d5aeba.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1756_156132921\42167b85-8ec7-469e-8517-07c138d5aeba.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1756_156132921\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Zer41BC.tmp

Path C:\Users\Admin\AppData\Roaming\Zer41BC.tmp
Size 2KB
SHA256 f477c23aede4ab9ca21929b9b1cecc3eb8e8cfe1b16dae791b52000f21c1a5d9
MD5 a6792dc8868f54362d3dc13e8671a4f7
SHA1 5529b109cfa281bbfa1e586da57caa64262cb8c8
SHA512 22b2c39374e8b5ca7e979837109e09dfa2e3171aa87e7077385979cf52b7439c4f9812cf9c605e50eac14eff45314e6f1b16ae9c40715571a0711d055d45ed3a
TLSH
T121518C1940934616F7B35B998F5B31BC7346A6DC8AC651C4E53EB8B246D00A7F39D0C7
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 350180.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 350180.crdownload
Size 9.7MB
SHA256 d3e95d7ad01a4f2180e5efffb8f873e891a498fea9b85950f886e2d25fc486ab
MD5 fe9e560aabed765dac1566ec69ebfeac
SHA1 7dfe4f6313725c1846510c14c43c640166f946d9
SHA512 b0ff5017c71b924c131b0831bd441132dd42d98532eb9fdd44e863afc487d4bb0e8d40159d3bf7c3b956bd118c6098da0158b425d2e285ecdd2d228db7b182c7
SSDEEP 196608:Qq8/3w6fRQSKSLetCd2DmsxADnsf06FVmK+3pAZBrqSX:Q9FfRQSKxDmsxA6FIK+3pAD9X
TLSH
T1D3A6AE22B900C032E8D101B2D6BD5FBA9D7D99340B3954D3A7D46DB95A305E33B39B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/776-492-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2332-507-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-506-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-541-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-540-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-539-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-538-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-537-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-536-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-535-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-534-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-533-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-532-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-531-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-530-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-529-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-528-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-527-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-526-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-524-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-523-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-522-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-521-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-520-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-519-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-518-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-517-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-516-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-515-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-514-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-513-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-512-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-542-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-510-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-509-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-508-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-525-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-501-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-505-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-504-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-503-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-502-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-500-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-511-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-543-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-544-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-545-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-546-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-547-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-548-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-549-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-550-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-551-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-552-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-553-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-554-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-555-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-557-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/2332-558-0x000000007FE40000-0x000000007FE50000-memory.dmp

Download

memory/4440-0-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4972-498-0x000000007FDE0000-0x000000007FDF0000-memory.dmp

Download

memory/4972-499-0x000000007FDE0000-0x000000007FDF0000-memory.dmp

Download

memory/4972-497-0x000000007FDE0000-0x000000007FDF0000-memory.dmp

Download

memory/4972-494-0x0000000001FA0000-0x0000000002B1E000-memory.dmp

Download