5729c1c457c47b18c4032648cd16c039749c4f0b3117eb2f5654073df7d7cec0

Analysis

user interaction
yes
max time kernel
899s
max time network
916s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tele.rar
Size 221.8MB
Sample260730-drkn5a1zhy
SHA256 5729c1c457c47b18c4032648cd16c039749c4f0b3117eb2f5654073df7d7cec0
MD5 fca09a0d299d613d4a26ce9e60aeded5
SHA1 e42e632cf97fe492b3434627d702fb7bbfcf067a
SHA512 2c308b4ad2d7f5d1ff81a623178dedc4c9a4909b7bb3d4f62f4245a6e2ce92b569ac74159b5b4a07d67f15433781d83bba6ef1a817e6852e219fc773943a3941
SSDEEP 3145728:2hdGZFEa+wxWIB6BVY0Br8g8dQ45UQyRhC7Fi7zEQAjG268sVT3aDmDtHE:AdazxCXzCXUhC7FEzEQFLfVTKDAtHE
TLSH
T132B8332778C76F47DC09970AE4A4054D876BC7822201F077F1B7BDE3B41EAA56AB94C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
281	4864	chrome.exe

Executes dropped EXE 15 IoCs

pid	Process
1000	RobloxCrashHandler.exe
4580	RobloxCrashHandler.exe
2648	RobloxCrashHandler.exe
3400	RobloxCrashHandler.exe
2080	RobloxCrashHandler.exe
3436	RobloxPlayerInstaller.exe
2380	RobloxPlayerBeta.exe
704	RobloxPlayerInstaller.exe
4500	RobloxPlayerBeta.exe
4976	RobloxCrashHandler.exe
5048	RobloxCrashHandler.exe
2704	RobloxCrashHandler.exe
1888	RobloxCrashHandler.exe
4736	RobloxCrashHandler.exe
2004	RobloxCrashHandler.exe

Loads dropped DLL 2 IoCs

pid	Process
2380	RobloxPlayerBeta.exe
4500	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
2380	RobloxPlayerBeta.exe
2380	RobloxPlayerBeta.exe
2380	RobloxPlayerBeta.exe
4500	RobloxPlayerBeta.exe
4500	RobloxPlayerBeta.exe
4500	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\graphic\gr-numbers.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\DeviceEmulator\sim_console.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\DeviceEmulator\sim_virtual_controller.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\StudioSharedUI\videos.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Emotes\Small\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\TopBar\leaderboardOn.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\MicDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\SpeakerDark\Unmuted80.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Moments\Reactions\heart-xsmall.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\Help\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\Players\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\Misc\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\Controls\DesignSystem\ButtonL3.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\ImageSet\AE\img_set_2x_3.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\graphic\gr-profile-150x150px.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\BuilderMono-Regular.otf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\PurchasePrompt\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\RedSpeakerDark\Unmuted60.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Emotes\TenFoot\SelectedGradient.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Input\StrafeButtonRegular.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\PlatformContent\pc\textures\sky\sky512_dn.tex	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\PlatformContent\pc\textures\water\normal_23.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\icons\ic-robux.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\DevConsole\Filter-filled.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\DefaultController\DPadDown.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\InspectMenu\ico_alert_tilt.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\LegacyRbxGui\Cement.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\SpeakerDark\Unmuted40.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\AvatarExperience\PPEWidgetBackgroundDarkTheme.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\MenuBarAssets\MenuButtonSelected.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\ImageSet\LuaApp\img_set_3x_3.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\graphic\Auth\logo_white_luobu.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\DefaultController\ButtonY.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_6.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\AvatarToolsShared\RoundedBorderRight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\XboxController\ButtonLS.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\InGameMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\MenuBar\icon_leave.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_1x_7.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_20.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\ImageSet\LuaApp\img_set_2x_4.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\avatar\abilities\AbilityManagerActorClientInitializeIsLocalScript.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\MenuBar\icon_maximize.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Emotes\Large\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\InGameMenu\QuarterCircle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\PurchasePrompt\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\AvatarEditorImages\DarkPixel.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\vr_idle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Chat\ToggleChatDown.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\avatar\abilities\AbilityManagerActor_fullHierarchy.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\MenuBar\icon_emote.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2488	3436	WerFault.exe	133
1116	704	WerFault.exe	146

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4864	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX-PLAYER	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298556410457660"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-ff6341faef444107"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX-PLAYER\SHELL\OPEN\COMMAND	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-145f189a6a974303"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX-PLAYER\DEFAULTICON	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX\DEFAULTICON	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX\SHELL\OPEN\COMMAND	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-145f189a6a974303"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{261C2AEA-DA41-4BB6-9A56-B68C4606D6DC}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-145f189a6a974303"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-145f189a6a974303"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1000	RobloxCrashHandler.exe
1000	RobloxCrashHandler.exe
1000	RobloxCrashHandler.exe
1000	RobloxCrashHandler.exe
1000	RobloxCrashHandler.exe
1000	RobloxCrashHandler.exe
1000	RobloxCrashHandler.exe
1000	RobloxCrashHandler.exe
4584	7zFM.exe
4584	7zFM.exe
4580	RobloxCrashHandler.exe
4580	RobloxCrashHandler.exe
4580	RobloxCrashHandler.exe
4580	RobloxCrashHandler.exe
4580	RobloxCrashHandler.exe
4580	RobloxCrashHandler.exe
4580	RobloxCrashHandler.exe
4580	RobloxCrashHandler.exe
4584	7zFM.exe
4584	7zFM.exe
2648	RobloxCrashHandler.exe
2648	RobloxCrashHandler.exe
2648	RobloxCrashHandler.exe
2648	RobloxCrashHandler.exe
2648	RobloxCrashHandler.exe
2648	RobloxCrashHandler.exe
2648	RobloxCrashHandler.exe
2648	RobloxCrashHandler.exe
4584	7zFM.exe
4584	7zFM.exe
3400	RobloxCrashHandler.exe
3400	RobloxCrashHandler.exe
3400	RobloxCrashHandler.exe
3400	RobloxCrashHandler.exe
3400	RobloxCrashHandler.exe
3400	RobloxCrashHandler.exe
3400	RobloxCrashHandler.exe
3400	RobloxCrashHandler.exe
3400	RobloxCrashHandler.exe
3400	RobloxCrashHandler.exe
4584	7zFM.exe
4584	7zFM.exe
2080	RobloxCrashHandler.exe
2080	RobloxCrashHandler.exe
2080	RobloxCrashHandler.exe
2080	RobloxCrashHandler.exe
2080	RobloxCrashHandler.exe
2080	RobloxCrashHandler.exe
2080	RobloxCrashHandler.exe
2080	RobloxCrashHandler.exe
4584	7zFM.exe
4584	7zFM.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3448	chrome.exe
3448	chrome.exe
3436	RobloxPlayerInstaller.exe
3436	RobloxPlayerInstaller.exe
2380	RobloxPlayerBeta.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4584	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4584	7zFM.exe
Token: 35	4584	7zFM.exe
Token: SeSecurityPrivilege	4584	7zFM.exe
Token: SeSecurityPrivilege	4584	7zFM.exe
Token: SeSecurityPrivilege	4584	7zFM.exe
Token: SeSecurityPrivilege	4584	7zFM.exe
Token: SeSecurityPrivilege	4584	7zFM.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe
Token: SeCreatePagefilePrivilege	3936	chrome.exe
Token: SeShutdownPrivilege	3936	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4584	7zFM.exe
4584	7zFM.exe
4584	7zFM.exe
4584	7zFM.exe
4584	7zFM.exe
4584	7zFM.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1000	RobloxCrashHandler.exe
4580	RobloxCrashHandler.exe
2648	RobloxCrashHandler.exe
3400	RobloxCrashHandler.exe
2080	RobloxCrashHandler.exe
4976	RobloxCrashHandler.exe
5048	RobloxCrashHandler.exe
2704	RobloxCrashHandler.exe
1888	RobloxCrashHandler.exe
4736	RobloxCrashHandler.exe
2004	RobloxCrashHandler.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 1000	4584	7zFM.exe	97
PID 4584 wrote to memory of 4580	4584	7zFM.exe	100
PID 4584 wrote to memory of 2648	4584	7zFM.exe	102
PID 4584 wrote to memory of 3400	4584	7zFM.exe	104
PID 4584 wrote to memory of 2080	4584	7zFM.exe	106
PID 3936 wrote to memory of 4192	3936	chrome.exe	109
PID 3936 wrote to memory of 1604	3936	chrome.exe	110
PID 3936 wrote to memory of 1604	3936	chrome.exe	110
PID 3936 wrote to memory of 4864	3936	chrome.exe	111
PID 3936 wrote to memory of 2740	3936	chrome.exe	112
PID 3936 wrote to memory of 2740	3936	chrome.exe	112
PID 3936 wrote to memory of 2136	3936	chrome.exe	114
PID 3936 wrote to memory of 2136	3936	chrome.exe	114
PID 3936 wrote to memory of 1228	3936	chrome.exe	115
PID 3936 wrote to memory of 1228	3936	chrome.exe	115
PID 3936 wrote to memory of 2032	3936	chrome.exe	116
PID 3936 wrote to memory of 2032	3936	chrome.exe	116
PID 3936 wrote to memory of 2320	3936	chrome.exe	117
PID 3936 wrote to memory of 2320	3936	chrome.exe	117
PID 3936 wrote to memory of 1884	3936	chrome.exe	118
PID 3936 wrote to memory of 4796	3936	chrome.exe	120
PID 3936 wrote to memory of 4796	3936	chrome.exe	120
PID 3936 wrote to memory of 568	3936	chrome.exe	124
PID 3936 wrote to memory of 568	3936	chrome.exe	124
PID 3936 wrote to memory of 4332	3936	chrome.exe	125
PID 3936 wrote to memory of 4332	3936	chrome.exe	125
PID 3936 wrote to memory of 4772	3936	chrome.exe	126
PID 3936 wrote to memory of 3708	3936	chrome.exe	127
PID 3936 wrote to memory of 3512	3936	chrome.exe	128
PID 3936 wrote to memory of 4200	3936	chrome.exe	129
PID 3936 wrote to memory of 3448	3936	chrome.exe	130
PID 3936 wrote to memory of 3856	3936	chrome.exe	131
PID 3936 wrote to memory of 3856	3936	chrome.exe	131
PID 3936 wrote to memory of 1704	3936	chrome.exe	132
PID 3936 wrote to memory of 3436	3936	chrome.exe	133
PID 3936 wrote to memory of 1564	3936	chrome.exe	136
PID 3936 wrote to memory of 1564	3936	chrome.exe	136
PID 3436 wrote to memory of 2380	3436	RobloxPlayerInstaller.exe	137
PID 3936 wrote to memory of 704	3936	chrome.exe	146
PID 704 wrote to memory of 4500	704	RobloxPlayerInstaller.exe	147
PID 4584 wrote to memory of 4976	4584	7zFM.exe	153
PID 4584 wrote to memory of 5048	4584	7zFM.exe	157
PID 4584 wrote to memory of 2704	4584	7zFM.exe	160
PID 4584 wrote to memory of 1888	4584	7zFM.exe	162
PID 4584 wrote to memory of 4736	4584	7zFM.exe	164
PID 4584 wrote to memory of 2004	4584	7zFM.exe	166
PID 3936 wrote to memory of 5060	3936	chrome.exe	168
PID 3936 wrote to memory of 5060	3936	chrome.exe	168
PID 3936 wrote to memory of 1004	3936	chrome.exe	169
PID 3936 wrote to memory of 1004	3936	chrome.exe	169
PID 3936 wrote to memory of 3248	3936	chrome.exe	170
PID 3936 wrote to memory of 3248	3936	chrome.exe	170
PID 3936 wrote to memory of 2944	3936	chrome.exe	171
PID 3936 wrote to memory of 2944	3936	chrome.exe	171
PID 3936 wrote to memory of 1640	3936	chrome.exe	172
PID 3936 wrote to memory of 1640	3936	chrome.exe	172
PID 3936 wrote to memory of 5072	3936	chrome.exe	173
PID 3936 wrote to memory of 5072	3936	chrome.exe	173
PID 3936 wrote to memory of 1468	3936	chrome.exe	174
PID 3936 wrote to memory of 1468	3936	chrome.exe	174
PID 3936 wrote to memory of 4328	3936	chrome.exe	175
PID 3936 wrote to memory of 4328	3936	chrome.exe	175
PID 3936 wrote to memory of 2248	3936	chrome.exe	176
PID 3936 wrote to memory of 2248	3936	chrome.exe	176

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\tele.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Users\Admin\AppData\Local\Temp\7zO8E1AC13B\RobloxCrashHandler.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8E1AC13B\RobloxCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1000
- C:\Users\Admin\AppData\Local\Temp\7zO8E119D4B\RobloxCrashHandler.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8E119D4B\RobloxCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4580
- C:\Users\Admin\AppData\Local\Temp\7zO8E13996B\RobloxCrashHandler.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8E13996B\RobloxCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2648
- C:\Users\Admin\AppData\Local\Temp\7zO8E1C7B8B\RobloxCrashHandler.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8E1C7B8B\RobloxCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3400
- C:\Users\Admin\AppData\Local\Temp\7zO8E1769AB\RobloxCrashHandler.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8E1769AB\RobloxCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2080
- C:\Users\Admin\AppData\Local\Temp\7zO8E1E8A50\RobloxCrashHandler.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8E1E8A50\RobloxCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4976
- C:\Users\Admin\AppData\Local\Temp\7zO8E1D3370\RobloxCrashHandler.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8E1D3370\RobloxCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5048
- C:\Users\Admin\AppData\Local\Temp\7zO8E1FC6F0\RobloxCrashHandler.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8E1FC6F0\RobloxCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2704
- C:\Users\Admin\AppData\Local\Temp\7zO8E130111\RobloxCrashHandler.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8E130111\RobloxCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1888
- C:\Users\Admin\AppData\Local\Temp\7zO8E129C31\RobloxCrashHandler.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8E129C31\RobloxCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4736
- C:\Users\Admin\AppData\Local\Temp\7zO8E109321\RobloxCrashHandler.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8E109321\RobloxCrashHandler.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa6eacc728,0x7ffa6eacc734,0x7ffa6eacc740
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,17262315331718228725,2348423882922185864,262144 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,15630664143940754546,18438401845152836735,524288 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,874618971790085785,7535768920537738027,524288 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,8708873569527634440,11483905860873903311,2097152 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3464,i,14177078790972823515,14083882901002211458,2097152 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4528,i,304982298022953782,6978513491918715974,2097152 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4552 /prefetch:2
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4780,i,12878314088329408047,6212760678412686600,2097152 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,17476725671578914193,911435965528302547,524288 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5556,i,9336641336418857322,15134229183639688120,2097152 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3456,i,9721229833912447926,12240737876821255266,524288 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6056,i,16311930474699245176,9741062910973117712,2097152 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6300,i,9828456557547850333,1538719614729862266,524288 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=240 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6296,i,13019639905843290890,5617167694553961237,524288 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6280,i,11309265855808619772,16691305146927512778,524288 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6620,i,4113307785344957859,18430446911338534037,524288 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6804,i,7861715299423867448,15780844273014408137,262144 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6816,i,12966009031650633183,4266569253847262913,2097152 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6892,i,3998509719515419732,6133284209915081249,524288 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6900 /prefetch:8
  2⤵
  PID:1704
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 3436
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:2380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 848
    3⤵
    - Program crash
    PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3096,i,13951962005674523266,443088045980895327,524288 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7092 /prefetch:8
  2⤵
  PID:1564
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 704
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 704 -s 1136
    3⤵
    - Program crash
    PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6844,i,1748080389947373911,11423192393690919357,2097152 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6540,i,11800545401829803810,13099599467812391601,2097152 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4560,i,17760826238345173110,17242564412868183201,2097152 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=240 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6412,i,466184100140119545,12485826428580564369,2097152 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7236 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7160,i,2321985414896265596,2046112602009217558,2097152 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7264,i,5982760232875618388,5884087525034680609,2097152 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6764,i,4548545340855975545,14228531620699174961,2097152 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=7380,i,2165057223113876046,7829730296686730835,2097152 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7336 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=4016,i,60236619413550524,6613063033597293641,2097152 --field-trial-handle=1960,i,14584141136176922394,588945636714894909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7376 /prefetch:1
  2⤵
  PID:2248

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2780

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3436 -ip 3436
1⤵
PID:1116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 704 -ip 704
1⤵
PID:2052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.7MB
SHA256 a33eeac3fde1d1f99de2df08d63faa818ffdfcf2ace6a37e11bec1fe59409c5f
MD5 ad0dfa05fcbf007b1e2e535139317ae1
SHA1 8bff45114123dad46374913eac070a7255ca57df
SHA512 98e470bec6520eff7ff701d3448dff3682c39a1a9f95211595cb6fd5fde63ba26aeb79ccd32fe7adc1ab3e27d551474e41d4e56c1e2d8f01d4cfe9715c7c234b
SSDEEP 196608:ivgkZi/+KxW/hvjyysmsxP66IM5e5QIfqZzcz9P:iv3KpysmsxC6d5e5QI8G
TLSH
T17FA6AF22B900C032E8D100B296BD5FFA997D9E340B7954D3A7D41DB95A705D33B3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppSettings.xml

Path C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\AppSettings.xml
Size 144B
SHA256 d5de39863fe721668ce1e115e0fc55a7c733747daff6235d27dad3d160c84dbb
MD5 431a6eb20932ec1c56682a1f60d231d3
SHA1 40bb32db040cabade103c21ba5b6f811dfb0773e
SHA512 0969b9484bb7c661d4e0452ff1c77396796333904b39f24c56d5a92ac4ed4ebde9b8981a985c6950b4af2852e8d9599e071a51ce4f9ef21ead778a2fdc76fcec
TLSH
T18AC09BA45351C4149795CF14977DF690E3B1797444504498D8A1785A0DC51D427D53A3
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.dll
Size 21.2MB
SHA256 269af4ce0111e647c0a7ca5d7f1e29d769c880fd6394bf03f8a368e5c34761b8
MD5 42aa3722cc784eb50ec34b639665a129
SHA1 2cd51a6517fdd48dc01e322b7590c93712ae5fa9
SHA512 9570b27b9db7bd62f57d40f49c22fc536f58adc436cb7f818c943ab03b3839d4b9526b925d4bc0e9f9b4f440df6cfa045ecd8406f9df66048c041e328720eb3c
SSDEEP 196608:mTQLBStMScC8/lZZKPBJw5v8zOcPAhO+D9T:mT4BShEv87Eve4hOaT
TLSH
T1EF27C08EA4D20AA8C6A25071F05F46D3E662304C0D6C6DF7C6FA02603673B9D6659F7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roblox Player.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\Roblox Player.lnk
Size 1KB
SHA256 8bc483e11414d11ef46ed413e032fc66c66d21e7077ba8e9ea01f9e01b25ece1
MD5 79814648d76d2b4cb8a403dcea8fa5ef
SHA1 88071c2756aa80b7d99de6baaed19a85011d696d
SHA512 1aa0bdfac91363a3213e9150a3c69e42773f115ad44a8c11a96b1fc7712bcb8895480b8533b80b58b9359dee514a72ec32b45ba293556cbd005c552aa24f743f
TLSH
T1B4219E514EF51716F3765A3168A50256E7737C02FFA87E2E4185334D1B61100A998F7F
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8fab9905d62bef8ee40a5cbf10d27a933876d7c2f59a822c4773f667103e16cf
MD5 930cd927e3a8eb02c5569e5eaadd770b
SHA1 236a9c77ec597e9a47a23cb1d49cfd5b12b90564
SHA512 6ee5a1c132271d33fda34351e2b54ff2d0a30ca4b108258e6d1489b4acc2f8b53e097d45d05e765d89e0fb6809c075d46f91cd8256dd0fe05ef113b216b5dc59
TLSH
T105E022AAC961AC772DFD071860914B05EE5513272E80992F3A3CE20C8FB162A4A8AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 373KB
SHA256 00dcd72487112e44ba2487e5eb363a98d65f14344edef5293c8e9dd52850ee58
MD5 ad6388a08d35f6d67db1213404b7f81d
SHA1 55cb415cfa760fb4beda8422d7c635cd4caf1915
SHA512 1b92070f13725fbe34b18dce86e09ee76536ef7dd7190f2c11d54f71b91acdfd40f03c8972a85099b988fae24eaec038be967cbe7b57783340140481b9362248
SSDEEP 6144:qm2dRYZtgXkt4w9410UKjgGHjMaP8RVkqSRhP58OU5R67u4nORWO7lQ8E9:C8tg599lGDBskZP58B67znOwGQ8E9
TLSH
T1A084232C983F6900BB0252741FD6C76E4FF40988A2C0D4C28254A193F9B7EA7F5A7779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 84KB
SHA256 b02d81653438f2206e406fe74f198c4081b749f7ab9e5a2de8c1fcf349bf0f82
MD5 a06a101f4e9ae9bc3c7185f29d973177
SHA1 71ad19396030d4f261a2b79d182e107583b81016
SHA512 b022a01a0aadcaa3e9f8ede517d02121f852b5d20a3f0e07f76a01d73c412caff82f6ed33f8e8b459706741720002af2c8047988e7c4d96d360348d73cb8c1f4
SSDEEP 1536:X/Vo6Xtocjv/2uDQOwVIC+Qo+kgi1GbP5xunBQ+JPqiCEyDddmWOGPR7hjMHy5sK:X/Ntnj3BwVNfzq3lCEyYGPQHymvMNrY+
TLSH
T10A8302D04C3B7A5463A19924C5CF3A4CD4E1A65F9F97E8AD8C89B39B11F640E3C0E84C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
Size 436KB
SHA256 0b320d2cf00e9215763a5377904e2301b2edb7a5d299bd319259714cf8bcd9a9
MD5 38e965609b7e0769e6754549cfa3c2fd
SHA1 8ef9e62fa3ae6d8b371f5a9e9344a6cdf31515fe
SHA512 18cff962b979abf3e3d06261422f35502463a0e196aa0cf801cadcff8833a83f20c9e9f22fb3133041e406fdf2304088a0a5eaa4bbb8aff07ab15a0c1b46b0e4
SSDEEP 6144:HT+7EhQjYpz+XUGr9+7Km54TxcjJJEWv6p0qOJ7kuKtAiDL6GnkES7+S8HBWzDi2:6vj0iUI9EKFEJdU0p7riDxw7L8oviJ3c
TLSH
T147942367DF08D99BDA158361EA30EBDD1158EB6EE00A3CC844BB462CE54C0F9F6913C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000146

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000146
Size 510KB
SHA256 37c27e82897d665f79faccf3ed15be9f3cc3aa96157100e1447905b36151180e
MD5 87e97691070638eb9efd58c637feffb1
SHA1 11dcac90b71da96fff6e76f5fedf1d2824a0476f
SHA512 ae570ddd6ec7d5d9de5824acf5f3644a5170fe502bd4d6f4326601299401b42e73bf7cc5efaadd39aeb9e7c829b78a69c3bb3185709b520944082aab822783ee
SSDEEP 12288:ODG/DZ4rydlALqBbwfO1EPsX4O0YQgf1fFkGZMVIfO:Oy/DOufqtOAhGZomO
TLSH
T180B42381177A1FAFA0901E9E98020EE44FD9E2A9F5F04379EF1015F8A5ED1B5A474F07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00016b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00016b
Size 21KB
SHA256 2a0b7c30f0977fb1625451633b6b398f1f2c69d01c655bba3918c961b66a0583
MD5 8a2c36b90c9c621271b5b157ed86e56b
SHA1 f542f96bdc7ea0f2acfd8cd9353ad01d722256a2
SHA512 10ab9e8180698c4f5570b516c20c7282c50755a33c9215c9bb97d58990004f614a95c06fcf5dd2fbb844e24a5d81332ebdffa5c89cd4b22ee46828d5deab1bd4
SSDEEP 384:3YCbDPjmywD3fwAJ2ZmSMqcHbjgog9rfaPkiTOi/dkewSpcE5uW:3sv0YUmSMnHgogxfadFkewc75uW
TLSH
T164A2E17711DD711BF84E9DE82DCE8ED5C8A9A0DE6C618C4047E014A8D0DEA760FFB4A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 54f750c00cbc273a1ca3a08568e7173d654bc2d497104e9867d659d0a04ef74c
MD5 c78607eea0eed6f34842dbb009f46d54
SHA1 45e469a4bc44b1ea1fe301e7fd2e115352543e2e
SHA512 5534ff3d086e8ef28462e987c94c219e9b4b717af862b69f092aeb59947b76053ce498b7edd26b26dff36b2ce376cdf9c68f0f1fb0574110dc2bad3c7be5993c
TLSH
T17E512B05A9E1FB10CFECF571C2BD5CA987D12D9A460267CF6A00206522CF7E0B5B2B97
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 8e8bf41e332426a15026d45c0d30157e64b969638f63bde5b662d7ab39e64ff8
MD5 6061bfb786aecbe421125396a523f19e
SHA1 8a7b66b03147f9d389b47a66a7c3beb9b02d3729
SHA512 ab12972c29883fbd1b3fc03e0816579e70efb7a0c2a7a77756a566ea240847bf607e0f432ddddc6c4fba8c48c7d98b5dc2faabd071505e8820d05bb80f629c36
SSDEEP 96:sgC1Xc7NeWrzrAuelAOCXXEz4NwK1woIHlLjn/EHel2hpFT5JZ9gzG/09hB20scL:sgE4/Dsr3euEam9GCv6SwV
TLSH
T1D2D1B501D195EBE1DFA8A7B0C86E0C7556B7599A520ADFAF040040BEF19F3E4D0E178A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 4ccea2aac7126a969d1fd248f3a10d3fa864911ed71d4577129d4fd2c90d1200
MD5 200044eac47c9f281732e89f8cf1aa6f
SHA1 a7c6d7ec281a8c3168cb88414d32536582412eff
SHA512 96eaa04776112daa26d58c84c281eab78a11c0824a625ba517c293128b32287fc7a79dcb09aca958a13759e48bc0db508e01597477bc7dcf1aca323d1988d729
SSDEEP 96:0bC1X6LN0xL1uHlAOo2O4NwKYwonJjn/Pel8h9j5JlzGj09hB2ncnh4uVFEoUX6A:0bE/9tX9LDUa29GCr0wF
TLSH
T1A2A1B242D1E8EBE1DFACB770C96D4C6857B229961245AFFF0500007AF18B7E894F138A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 011655e64ec9a1de557248e372bbee325228d8213b2a24ab68f8db3e56a8efa9
MD5 fb67bc36cbb519b857bc752b5a99b233
SHA1 ce5c6a114548a79afd5ffd03f7c11662a4668c3c
SHA512 755d87d193c51ac5d2fdeee9dd1ef69e57f2d26b6e9233a39de2218c928f935c5ceaea403dc172e595795f844f221565b1d12c8a90a446e8ad011e2469fa68e1
SSDEEP 96:kbC1XJMN0nLIuHlAO1OO4kKAwogjJjq+elknj5JlzGj09hB2ncXh4uVFsoUX69jW:kbEHGiC8qDUau9g0wo
TLSH
T114A17E42D5E0EBD1DF99B770C96E9C68A7B12A165602AFEF19004071F18FBE854F2382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 23523b7096c65ece9673b4a51026bf06eb333a532c9b5f62e6b1dabfa2003cd6
MD5 1eef5298f87b55a0ec55f5ca3f1efd86
SHA1 6d7b25e971fd0e88f16b180bf3f40fb704625ae2
SHA512 578952bb9c452df9339546fb22489a764b94cfe67dede1d0f8888f210d51ff7fd8da4ddf68b863403845737c541d4b1fad27d263ab35315fc7f6895ffaf6b802
SSDEEP 96:ybC1Xc7NeWrzrAuelAOCXXEz4PHXUKGwoIGljjn/EHel5hpFT5Ja9ozG/09hB20m:ybE4/DsS30flJEa3wZ9GC2vowU
TLSH
T13EE1C702D195DBE1DFA8E770C96E0C7556B65999020AAFAF050040BDF19F7E4D0E178B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 1fea670f9708b08cf0ad2ab414f700396f8d0234bcde36b8a73c9949f1a890ca
MD5 4112ce31c550c36eb92e4d5454f0c5fc
SHA1 2ccab41bc2ef9abbf25da6d98b2ac26aa4b7c5b3
SHA512 3052bf05ae2db7e4645e18671282d0d664df9efe4537837069ea8de5344f127703cdc9b4ea03010ff542207fa3d0485f4017fd5f58b572a3ad690058139b71bf
SSDEEP 96:27gC1Xc7NvWSC7AuelAOCXPz4NwK1woIBwLjn/EHelthpjT5JB9gzG/09hB20scM:27gELbzhA3DCEaJ9GC+fCw/l
TLSH
T1C5D1C502D1A5EBE1DFA8A7B0C96D4C6957B61996060BDFEF040040BEF09B3E4D0F178A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 1493f19aad1641ff0b40d70de5b1515f52b0553e9b8b7bda3ab0cb51c8e60651
MD5 ce7617a630938addd8dc25651e4f692d
SHA1 b56db289a8f8b13989122c6b10e5164dcee8b46f
SHA512 85be950f43a17ce829cc8c7d1128b70859f87e83eb1bfc883fb242eb6e29aa0a3362a59c206c5df8a3925966ae1775f3ffecd6a1187b1a5d450d05a0ff7b58cd
SSDEEP 96:ATC1Xc7NeWrzrAuelAOCXXO5z4PHXUKGwohGljjn/EHelZhpFT5Ja9ozG/09hB2w:ATE4/DcS37f1JEaKcx9GRSwTMwO
TLSH
T17EE1FA02D191DBE1DFA8E770C96E0C7516B65985160AEFAF0A0044BEF18F7E4D1E178A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000004.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000004.log
Size 94KB
SHA256 33f264ea172b8b2c75472fe10db2c52bc143ef0bec921697601041796dd84d7c
MD5 e25bf9b7db5c2ed64b795be8b6719023
SHA1 76d45beb4e3f0d2eb3794e08c7d69ea48af3cb9e
SHA512 d17ffa874d57df386c1e36d540540921562a5886ac5e5391a62ae9e87a2912c5fb3d95c62b3767409a81f347590ebbd32f1312841882d44998ee4caebbcbe09c
SSDEEP 1536:LMyp0Z27XMNM3pBgceoLKQIP5QxadP2RUtQwk/h47BOe1vyFre5fpcNLihpcRRZH:LMyp0Z27XMNM3pBgceoLKQIP5QxadP2j
TLSH
T1CF93694E3BA1C07AC0F541BFA9852FDE174A3F487F92471FA5C472A597326A60E27132
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000005.ldb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000005.ldb
Size 1KB
SHA256 dc3530bfe54343283c68a0c7e3eba93c7213652d8bed5e55615f4398dd818cae
MD5 7a7b308c810b37c1b60d972963e44a13
SHA1 2581f214ef4c85bbdae7c9e682f0778906152aaf
SHA512 5179a1665ba46caef334caa9c70fce1a37a7480764faf2bb628ef60979d590bf73176d8bf093548b796fdc9ca130293b34e744c5705d5ca8e38f267ecb6833fe
TLSH
T1D331A7176BACC03AD5041B3381E302FD87F573887D2156413D78A71E54276476CE7325
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG
Size 671B
SHA256 41278f1d974737215ce36b6b4f52a06cc24595de334ad1bb8ddcfc4f8172f468
MD5 29e32f3e8b2ea4242bddb37b29f4e774
SHA1 725895f01efa0a83fe0fbbaea8cb0a32d5019abf
SHA512 c2017dbe0933d5ddfe74d2ca51c180abe1abbf23e2d2d2dd2818ac33274c95a576ec57c9b6162aeb019bdb6af2135a35fa7049b0dc50250176ffe41d617c7093
TLSH
T1F30170EA86C6819E8041D12293283B8E89B35818A7CC6FE86F06FDADA5C0009D7891E5
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 100B
SHA256 7d830ca884f68a50b9c0df7ed54adbc5189579bf2494ada85929dc2c1f9c5166
MD5 56c8cde10a65967002de0ec6b652535c
SHA1 8e014ecc34813dcd9da6b81c9b85f896c6b7a8e0
SHA512 095a11f914a5251ca663ed70dc566e0329d5de4bd9f5bb64eb167e93e708177526278984f44aad4e60bd45e3238d81365e6d4d9a3cf18989bd40e6b19c095a54
TLSH
T1A5B0123853D11C65D166153C54BF41C8C9369460B103DB193318402D04025408D9C207
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 f5543a1240aa411bf3464e40d472a9fc736d50e70e26c89b9c3ae0c2f3b77ab1
MD5 1fb5ddb2405e77b8f52ac2a0247db508
SHA1 9d4b0d47d3482627c739bc242cda3b5e52f3d1aa
SHA512 a8bdea0def9657c721cfdb0d699509e15a68bde05eb044b954745c10c73a3d9f936af9e21295aab26a48b9e8b83571d4a0e2c29a72b1f69a0147905d447c16f2
SSDEEP 192:DvAE/aL4qIMaIOCur+0AkwCY4IQIUIGVNPHNhGMmHxYgA9XcCkQT7:DvAE/aL4jMaIOCur+0AkwCY4IQIUIGVb
TLSH
T1E602CEF3C3E8C62D891156F4EB156E1BCE290A28471C3C66C5D8BE1B93E3971E21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 e2cb0aa56dcbabc9168d56e4b3205eb2d920bed5fc73efc47d7a5da2f5ee45cd
MD5 ad1ff9b5b1fc230129615a28fa44ad4a
SHA1 6596c9566f0c885f3dcd3eea7db84752f883a441
SHA512 6fc0d89e84dcef5fb5a766a75e4693c40e527ac306ee89d768e2ede92220618d7c83420c2568da34313a27ffc28b8fc2dd910380f8be2f3172b91264c833beb6
SSDEEP 384:D0uWtQwE+bBl6j1SwVQK7FUe6JtJ4aIOIU9XAPmVtfLgpZwuGMxQjR5anz8hfVbs:gXEAu4Ex+a
TLSH
T14E72CAF783E8C52D891156F4AB19AE1FCE190A28031C3C76C9D4BE1B93E2572E20675F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 755cd36b3a78b1bf9f4a6e0b3ac1c8461a9336532c292ddd6c0fa5c315e211e6
MD5 0df7ba30ed3336d47a8070a72c07ba11
SHA1 2a66ef37a087f54f0b14190ac855a9f6e5dffd3d
SHA512 28471087cd2a8e8d07f8d007057c8f306ee82d65db16597a6b93c523170c8d7a912c2566bd701377fdfcc8e0ed75f224cb7cbe6e851e04272993abe363a8a7af
SSDEEP 192:DvAE/aL4qIQQ3L+uaIOCur+0AkwCY4IQIUIGVNPHNM91wav7PPjQTGhuZVQxtfZS:DvAE/aL4jQQ3auaIOCur+0AkwCY4IQIc
TLSH
T12A32DEF383E8C62D891256F4DB15AE1BCE290A24071C3876C9D4BE1B93E3971E21179F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 30505d5229998aa9c3eea6b7c7e9f227b408092ea6307c3281e580496bbc0761
MD5 7d9b3ae07c40b3b1f99f4769f63b0a4a
SHA1 556781a55a9897f4fe1e53b8a40450ac5614467a
SHA512 f79cf2e9d91da03c209115aceac6b2dd22169d1ca14033cf83d4b439497f4e904b5f1d58dfb47bd297f62ff0296f5e1c82a4f67769deea11b968b04dc9c6c0b7
SSDEEP 384:D0uQwE+bBl6j1SwVQK7FUe6JtJ8WLaIOIU9XAPmVtfLgpZwuGMxQjR5anz8hfVc7:zX/A3evUC3
TLSH
T1C672ABF7C3E8C52D891156F4AB19AE1FCE190A24032C3C76C9D4BE1B93E2572E215B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 084a229c64052d0f315ddbb8ae4914b1d2365280501d8f02c93c13274e31f824
MD5 a58039bc43a034c42c0729459f0b39a6
SHA1 c397328a29e25a08db828b68ef716fc6ca23029d
SHA512 0db1dd085fae7a3415d25e239fd66a0622cc533d092869acdd4fc7775a7b3ab6158fe01b6dc64c9f92260e397f6d84e274d541883a616e563dec3f10bef7f864
SSDEEP 384:D0uQw+bBl6j1SwVQK7FUe6JtJ8XHeaIOIU9XAPmVtfLgpZwuGMxQjR5anz8hfVcD:iXHA3eYHG3
TLSH
T15E72ABF783E8C52D891156F4AB19AE1FCE190A28032C3C76C9D4BE1B93E3572E21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 cc0686232df120ec569de2a01836f66ffdb89a30261ad1d567a04e643325c5d0
MD5 94b328ce3a7b0ef15885007ec2843524
SHA1 31504fc3ef42cbbd227f49614449763701565900
SHA512 749b7999e34297d2c8bdf89472a6096f633cf5fd11a7fe4aeb7903abe1c5e2f7f407156e7b560219d1821ead94044d0045f7d7d634b675675bd5694d85f2078d
SSDEEP 192:DvAE/aL4qIQQ3L+m1aIOCur+0AkwCY4IQIUIGVNPHN9XIfQTVtfZgpHwuGsHxxQl:DvAE/aL4jQQ3am1aIOCur+0AkwCY4IQP
TLSH
T1BC42CDF383E8C52D991256F4DB19AE1BCE680624071C3876C9E4BE1B93E3971E21179F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 2bfddaf3954fa94c770ce84c4ae35c17841b5be663ea4965d8983154ab3f59e7
MD5 1da1fc6be567e697a6f791306ef79677
SHA1 a0462823bb09190e0f8b4f86d677b8f66e422379
SHA512 e01b6be14499fd59721835dfe0de52f44b7821d3182511b825e732a0e7c36ed5cbffbf141011963cf355ed9d88566bb8be2fcb3995ea4da0c9ee1474b0bb80cb
SSDEEP 96:aAUaQUskUMtkUrVKUTeIUOJUY1/UD+oUjGUrUSUd/UdghUBpUhUOuJU8HowUiQU3:aAUDUPUikUYUSIUOJUY/U6oUiUrUSUdC
TLSH
T180A1AFA7927F746B242C497B1E487C0A55BAB83516D37CF5DB67826DB0828F30B12436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f1d1ef645e2cbc02c9cc23a26adb8f4fa8cf8bbd8e5b49b786e51b4eac3fb54e
MD5 923d8b120cffce7478f57e1b720d14e0
SHA1 0652b1891a6fb38f28294143a449491753268b43
SHA512 2ddbe436e04ea23d5fd60be0534c3baf6b1d5144cec6a8ed1eaece3d109adb310f376a627a786f6a15d66bea9a07fe8bba9f5da4ec30bdc18a5fefd10cb9c688
SSDEEP 192:SRymLqvPqQnWv7hpAPRp2HX495Hsb+WNn5f4Nz233e0/X02JTWVyIsnAUgtaJ:SRyQsi9UXFrwR22RX02JTu8
TLSH
T1DC52E92FBA10A53B5CCBC215F9617757EBF7142165A02D84EAFC896C05EB5CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 74096644696a90e401f7019f5cf68e4bd83001823c22be1a851760c199fdf1f3
MD5 76f8a6ebef426c12c891a72256d47248
SHA1 f1106186b33ac2cbebb000cc3cc11275e9cd21a2
SHA512 03eb32b059c698f89decd9bc6d99144bcda29d346ee462f9fbbe90ff48f35ba48b1c6df3e9703d9f6736daf1bbd0cbd0a327626af80108e225380584c106fdee
SSDEEP 192:SRCcBzmLqvPqQnWv7hpAPRp2HVBO95Hsb+WN875f4XEbmeno3e0/X02JTWVyIsnH:SRCmzQsi9UXbrwIkomenEX02JTu8
TLSH
T1E852E92FBA10953B4CDBC229F9617757EBF6142265E42D84EAFC892C05EBACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 0c62be352743d325add7490618f7b2de055f19ac4389d584d23d6282281df752
MD5 122a0a0981954977b8c079c8f2f782ca
SHA1 5c0f19beecd0968ee1ed276bf6c53d2d6495ec19
SHA512 1036f3c2b6b890a0017f6502c532bd581516cabe6e6329b350b33b2d9ae00ea96db2a37514acd1587b2e407964ad490989508283ac83b6af39d9cd951c5c38c9
SSDEEP 192:SRCcBzmLqvPqQnWv7jppPRp+HVBm95Hsb+WN875f4XEbmrovEH3e0/X02JeW8yI6:SRCmzQsiP3XfrwIkom0EBX02Jexe
TLSH
T17862E92FBA10993B5CDAD219F9617B17EBF6103165A02D84EAFC8A2C15E7ACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 c7f2efadc7b75792d5780bfb243f0c4e2f785b533360659c4b0a980175be07d0
MD5 e31171b11369b3dbb6712b0467cf4c5b
SHA1 73852d40fa814ab1c308732b4e874cd7a2b99f00
SHA512 325df24eaa2cff9da84ec99b1370d7646bf3ba43469c980dfa94855f129f5bf0815fd0a2c225564cd05cdbd2a0357b1f8511fc9ff4c5d68699c929b81be0d4c2
SSDEEP 192:SRCcBzqLqvPqQnWv7jppPRp+HVBI95Hsb+WN875f4XEbmrPU0w3e0/X02JeW8yI6:SRCmzEsiP3XlrwIkomo0cX02Jexe
TLSH
T15262FA2FBA10953B5CDAD219F9617B17EBF6103266E02D84E6FC8A2C15E7ACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 1fb15440e40717f0066a57c4676d6224cbd0ca80b93757c54795ef0e6c11ffba
MD5 2c0749da2d243c9aee6e44c81fe7ccff
SHA1 d994f50ceeaa266a06f7af7bd72d77a2f63874c3
SHA512 c6f9d3d8e2d9383f854cff78b7a4e4cc86a2d7aac18b28395833543f29dc20948edde0c02ebd316447de164d56e860afac7fe75a37312c7a67136e5bb727ec1a
SSDEEP 192:RRCcBhqLlvPqQxNv7jppPRp+H+vI95Hsb+WN87zgBrYln0E83e0/X02JeW8yIsnB:RRCmhEJtP3X2rwtWSE4X02Jexe
TLSH
T1BE62D82FAA10953B5CDBC219F9217B57E7F6102266A02E84EBFC8A2C15E79CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 0553e666dbf7f39e56c675eb5efda79a16c094b1d3716a6a03fee29c98343f9c
MD5 b583cd14dfd2a597dced7b0a6ed1f93e
SHA1 2d2476380368f15c45bc19989788dd96dd48b6dd
SHA512 40541cacc1151a83944ca4b834ccc09dee54c21e7f0c4627b587a1275d6921cdd59a5e32f3b55ae131f1811e218625f7ad603bd8bce21ac75f32cb45acec2654
SSDEEP 192:RRCcBhqLlvPqQx0v7jppPRp+HNlI95Hsb+WN87zgBzvNn0Ek3e0/X02JeW8yIsnB:RRCmhEJwP3XxrwtZ6EwX02Jexe
TLSH
T12162D82FAA10597B5CDBC219F9217B57E7F6103266A02D84EAFC8A2C15E7ACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 e539b34c2b066ba8f4b32191d05cb60754cfccc427501c7a10b70719508e58f8
MD5 cb95db535d5ba9141cccda9bb044426c
SHA1 b644f1792bd1d3d015f35851b1a6721dd1dcf4c5
SHA512 95f8fc7dc99a1f5af6ae6c3a2f2a6342d4e1c8182d74344969851b1f4a7c5c1905db3efca367642edb62be54fd9b255b109abbb850901ed0e04c4317adf33af2
SSDEEP 192:RRCcBhqLlvPqQaWv7jppPRp+HC3I95Hsb+WN87zgBhedn0Em3e0/X02JeW8yIsnB:RRCmhEiiP3XirwtCKE+X02Jexe
TLSH
T1A862E92FBA10957B5CDBC219F9217B57E7F6103266A02D84EAFC8A2C15E79CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 8d33b49c07387b07fae450611d0afe5d80820cdab81747552e6a303ab06503cb
MD5 f99ba12d04b255b98ccc6343c0bb875d
SHA1 dfb6105d14fdd5c8998f4cfbb9276e4da08c3659
SHA512 2eb5774a7c1c9dfa22a36c7bf2ab2d8a678afebe6603e8385dedfacba64c88588a259b0d3af088eebb957cc6058805e09ec8a699bb4584e2777c7aaaf19a6a61
SSDEEP 192:SRCcBzqLqvPqQnHv7jppPRp+HVBI95Hsb+WN875f4XEbmrn0EI3e0/X02JeW8yI6:SRCmzEsPP3XlrwIkomwEkX02Jexe
TLSH
T14462EA2FBA10597B5CDAC219F9617B17EBF6143266E02D84E6FC8A2C15E7ACC3213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b3725f9c388ce143c79e131cb8f4c8f4668f00b18b7bdda88a7b2619617105ef
MD5 9fead9c6873db82b9cbda11f06eb8f1c
SHA1 27f85e1918bf9fa82e3c4a15cf1fb184ceee9562
SHA512 e00b40f89da7b82d0dcbfb040bf437e7510622d3e9ef0a4e2817896442b6db05362e27ec45512f2595ffc39c819056ad95a306ccd4f9de1d1515d0d4ae152698
SSDEEP 192:SRCcBzqLqvPqQnMv7jppPRp+HVBI95Hsb+WN875f4XEbmrn0EI3e0/X02JeW8yI6:SRCmzEsYP3XlrwIkomwEkX02Jexe
TLSH
T19462E92FBA10597B5CDAC219F9617B17EBF6143266A02D84E6FC8A2C15E7ACC3213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 e1a8ca4ac70743d70054fd721bae734eb76354a2310a4233f17ac1cf8dc8030c
MD5 931e0d8439fbc7587f09bc89eecee31b
SHA1 5af0012e4998a006520d182973b6f3d1c0936cfd
SHA512 c6a15419e8426aef5fb3f28c27fe38e14077967c25dcb22ab35c017797f8b9477c69b50f63555fe73f83b713135e9d86674c2fefc7b879a989537036e90c8f55
SSDEEP 192:RRCcBzqLqvPqQxnv7jppPRp+HVBI95Hsb+WN87zgBXEbmrn0Ek3e0/X02JeW8yI6:RRCmzE2vP3XlrwtZomwEwX02Jexe
TLSH
T18162E92FBA10597B5CDBC219F9217B57E7F6103266A02D84EAFC8A2C15E7ACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 4ea31c5493db8de32febbcde51c6f422e2be687fc8346a4c2d684264aafa4977
MD5 b73cae5644fa7a700961a6b9951d60bf
SHA1 11dbae19cea2b92affa8ab66ede714ebfd1cf040
SHA512 75f7c61ea621f85cc1fd6a72fe835c2d791c1055aa84567f572ef24a25d5828f19739bf64a587de70877a502e323bb6c49de287248a95238dd73a211d21fa59d
SSDEEP 192:RRCcBzqLqvPqQx5v7jppPRp+HmBI95Hsb+WN87zgBg3dn0Ef3e0/X02JeW8yIsnB:RRCmzE2ZP3XwrwteKEpX02Jexe
TLSH
T1A862D82FBA10593B5CDBC219F9217B57E7F6103266A02D84EAFC8A2C15E79CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 59f92d39ac4b7d792e09d035ffaee1c65a6846d01c5b9e025c1b06955cb9163c
MD5 49607f52aa4f9836d0bba211e35bed8d
SHA1 95fb4474167ed0435202911690b0f8efdb952174
SHA512 e1f52c673ebe156a1efa5b4f7a15300cdada1d85ac7458233d9ba47a2a0e20eea5ad4144b3f70167f894246f3ab68bdbb14fb325ce14d5a40c01a9509df269bf
SSDEEP 192:SRCcBzqLqvPqQnTv7jppPRp+HVBI95Hsb+WN875f4XEbmrPU0w3e0/X02JeW8yI6:SRCmzEsrP3XlrwIkomo0cX02Jexe
TLSH
T17962FA2FBA10953B5CDAD219F9617B17EBF6103266E02D84E6FC8A2C15E7ACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a45996c40a7ef1e9a7d665e7c95c62447a158305bae5668458d0e6f4cb4badfe
MD5 f933b9f9cdc8cc9a58848b4f60c900b1
SHA1 378ea0de53e43fd15c9e0151268d617dbb67ca84
SHA512 a0c0c186b610ae887b29216b589370193b08d2a951c41744e4914983cc8a4572b64d82ad03354ead1b5d2b30267c6eb2befe476ac7ad6cddf2580f7192b666d9
TLSH
T11DB0121080415212C44202B01566688C7314AF28960E170573F8AD22C8355718414090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c6152.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5c6152.TMP
Size 96B
SHA256 9e63bea8778af99a993f8b9860ed3d5da6ff3fb5d7c6584ad3ce0168bd73fc64
MD5 4a47369ec29dfe0f0bfcea84ac8d0b8c
SHA1 a9a673aacf20016abb755de873fb42028ce6a048
SHA512 124d19aa13ffe94dd3244ae1f8d3ec653e516ed65b033d8c694a1e730fda72b6e215b0ed84faa800d2aa24030603d1668a3769c4d472c558d132664774f01371
TLSH
T118B02200C0022302C00203B0208088EA3038FFA2CE032202E2E02B33FC2323222200B0
MD5 SHA1 SHA512 TLSH

Submit Download

70beca8ba48c5564_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\70beca8ba48c5564_0
Size 255KB
SHA256 bfd030dfaeeed4bfd8c4887634abc45ac21e0dffe88fff1dda28557913e28407
MD5 b58fab7f0c3b30dedb5e351158540c78
SHA1 98fddc37b75894c282afa702261dfecbbb961fb4
SHA512 bfa4b2cef98139ef954d691ee2d173e8088d757f1226e830793a468473813c1c3473bc389d1bf13d18cdeefcc57d3905fe40fb84f4f9986192389a3d628168e6
SSDEEP 6144:QIjv/6CNHJ3ghfu0OqA4oPuqhDo4E4cH515w5P5+rIP7U0WwN8H:QIjiG0Rje5Do4E4036hWIP7U0WwN8H
TLSH
T1FF447D723300A53FA8278AA1E67E7F4D3835E217DD2706B8D2E4E9358FD2DFA1412548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 2fff92dfca660e01d5e9aa907bcd44aab5412e7d97b88194ef0c236c60bc7e8b
MD5 1d8e78bad75fe15de4b7b3a5e2f715e9
SHA1 aced31ecb598a69746fae5a51a069214f767366d
SHA512 2d92605b0da5a9365e2162a57283c1f61edc6c5f4e4205f1f47f6b67a74dbb42e02cb7507af496e75d4e9c6575c7fe3c5c22905971827f30fc30f277981d5c8b
TLSH
T14EA0023501C40231D04D03711083014032218D5405E5074181D01044DDAA1806E26952
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 ad4aaee7bc727b42e709f32242028808656487e2622a5309df4bc798d1b6ba25
MD5 518d4a17b238de21866b481068332263
SHA1 408bf993695955d85eb1c0e95311b02074b6bc1a
SHA512 50f706c68532eabdc04d32c00845aaa2939b27c0e7fef08fd2e5c510efd1405de90d8567e85f48e71a03fa01b7b1cfd04d16494dbe1da3fe47b77f6332a01ac0
TLSH
T15AB00294C1C816A2ED0C03B113C6148E73629D1C13F3DD9295A017A8EC36783A7A6A92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 234B
SHA256 2654a8ce1ee54bc53376aa2f78878ede700e34f6ea7ab1ae8944f864e8df4f91
MD5 5d7fafe7449016d71b83b971dc6da255
SHA1 264b071d624a296295fe19f207f82c1c1ce7acc4
SHA512 f78626cad57d3cc488cc1b7ba7784778053fb2ce681fa9903bcc3d87979e7dd60f423fd834e0e24130e8dd7a526c83dbd870a77cddf2d3e4a44727b5a831e347
TLSH
T1C7D0A7D75BA5855B1636E6D4102D704ED47BA9448CC4DCECDD09B16314F87328412968
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 150B
SHA256 356973d37355dd2110fc994e8f3001b01fb2fb637f10a75b482e5f465249baed
MD5 978d5e87300f0a6d61754dec835e5a5c
SHA1 c2d7a85025b5f570e08c1c01bca7d753ec9ebd5e
SHA512 75f1879abe57e12abb4ddebdcfb1ab9fd96296681f780e760e5a38f9e91db2c6376ec799b4c2aa54525c2a96431b15431b1ba09d8f787b27958108a501c9f6e2
TLSH
T16FC04CD71E54855B467ADAD8101CB11DD56B92588CD9DCFC990D81221578A364402568
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe6228df.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\CacheStorage\index.txt~RFe6228df.TMP
Size 157B
SHA256 fd793f6682e030341637a163518a94f0b9b3fe498b92181d9535c41e637989d6
MD5 3ca2cb88a74862a2875654c2b0aba541
SHA1 4526350eddc331df78ac14a55782e83f76ebb616
SHA512 5f833fddccfe221acacf7ae4eb2f0ba22a193ebb082dd731d1ad263f441258b36798dcaa44f2ef463224d840df6b0068b337822fd5e32afe093a2fd7fc3b63a5
TLSH
T191C08CD30E5441574776E6C4102CF10DC5AB9D588CC4CCFC980AB1222078A334001428
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 7159e598b1690ccdc99a5161313a5236b411f02fd79fafec2ac0f207939e6558
MD5 ac178ddb2aeff0f0b54bca0779209b79
SHA1 c438d3bc3e57bc8537508accf68de7e6bc7f6ead
SHA512 e711c8e6963926fd2434aa51062853a4b2114708baa6342e787bb974daecee12eff6c14ab76b7878881c08f33efa1558eba2a65ac5ba59bb40f46a6927580fd5
SSDEEP 3072:CnwlPDI9nFsIywrWgwzeY/0syjoF4eyGqg8Dqfd7NtZL8cHQRZEQ6Spsa:ROy/eY/0Ljo6PGqnDqZ/ZLW3Exa
TLSH
T1B9342233EFD37F32188285387053DD9C6576108291ACE351AFAE7BEF6B938816851CA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ea1634a5d9ba7a8df872fd5ebe70284d38c6087730364a453832d4e495a3db76
MD5 8976b3f7a9f7af4ccd41360c5d002963
SHA1 e7a125fd1e7f700149d72af18b2f46502a53b038
SHA512 7c7b42c4e61d7f591fce09d045e03c3b5dcbe2fb2706f93558dd46ffdd8a26a397d5fb8be165bdb44fd42665322f5a608c9d9143992c690f5decf14e6cfb1bd4
SSDEEP 1536:6DyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:Mqfd7NtZL8cHQRZEQ6Sps9
TLSH
T169C30237EBC25F335D82CB64BA534FDA67B644A99030D301AABD3BFB6C93451648249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 eac4d068c5f27c3f46f12c8be2cca3c0f018e500786d2117a072cdbee64948f5
MD5 51152790c2af1141c889e15e45e01766
SHA1 02b39fc8b9d53181ddd868ded85d4a23da318a5a
SHA512 39f76cebec24355a9058682ea63708ec7a21116b73c0356c4939bde28e818ad29e4a28418413f9a7541b67825e8a9712e37047108446f3a7bdbd1a48bee4dadb
SSDEEP 3072:hswlPDI9nFsIywrWgwzeY/0syjoF4eyGqg8Dqfd7NtZL8cHQRZEQ6Spsa:htOy/eY/0Ljo6PGqnDqZ/ZLW3Exa
TLSH
T1F6341233EFD27F3218828534B053DE5C59B6108795A8F341AFA97FDB2B978816C51CA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 bf15338880c757e7421a7e525cc87ea470fbe529b89bb0d2b418b5fb915dc52f
MD5 de3fd107de1b61164ee50f4932d16f81
SHA1 187f23ee75f08776a26177a93a7dd773c7187c79
SHA512 98efdda7c3bd78c55a796965c9e0c5137a861aafe35db74fba7ea157ce87ecc6bb32908d5e14b3e0c29a0a3f8c609b970dcbfdf8039fbe7d06781ba1425b90f3
SSDEEP 3072:NswlPDI9nFsIywrWgwzeY/0syjoF4eyGqg8Dqfd7NtZL8cHQRZEQ6Spsa:NtOy/eY/0Ljo6PGqnDqZ/ZLW3Exa
TLSH
T1DE341233EFD27F32188286387053DE5C59B6108795A8F341AFA97FDB2B978816851CA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 cb22b4eadb864a17899bb9c789f3b6139d88d12d4704c39b1f56a5a0fe80da30
MD5 c2f0825da47b0d14f8508d65e7197e90
SHA1 298b557a5920ec7ab8444de50ad2067cfe3ea163
SHA512 c735127e88b77369d9b97020010e2a53f8d64a70904b855ab3e6406a5355e028aad87787cd3a67c1488da7d30dbe248f9c3026f7f92db0dc6361752c7e09934c
SSDEEP 3072:HnwlPDI9nFsIywrWgwzeY/0syjoF4eyGqg8Dqfd7NtZL8cHQRZEQ6Spsa:uOy/eY/0Ljo6PGqnDqZ/ZLW3Exa
TLSH
T1C5342233EFD37F32188685387053DD9C6576108291ACE351AFAE7BEF2B938816851CA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 1200c72d67c1e0835fb4478fce7c7b83ab81e51502e42b6251da98a4199eeee0
MD5 526796de147d228f3f3054bb4cd6b273
SHA1 b3c4ef30ae78224ed1c6762059fc205f37467d51
SHA512 ba9b3da005d79580fb17f0bdba47f8a646c94e3c554e32f206e27963002eeed72d5bcd2d11493cd3c8abcf0d5eec17c6d86f9dc4ef6f8314241b997acac55c3b
SSDEEP 3072:VswlPDI9nFsIywrWgwzeY/0syjoF4eyGqg8Dqfd7NtZL8cHQRZEQ6Spsa:VtOy/eY/0Ljo6PGqnDqZ/ZLW3Exa
TLSH
T101341233EFD27F32188286387053DE5C59B6108795A8F341AFA97FDB2B978816851CA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 5ac71e1d734d51cb9fa2909093fbc32552748c57dd846fd7fc165d48bacf5f91
MD5 87df21387767556c14ef601d27830885
SHA1 0241550dfd8b9267db26786f48c959b4167199bc
SHA512 efc283bed46b16203884a9ae5f7da91388d240375cfdd415957d5c35ca861793fd0e7360c02cea69ea77ad387238c22e17d94ee6ccbc5eed4d925295893a629a
SSDEEP 3072:OswlPDI9nFsIywrWgwzeY/0syjoF4eyGqg8Dqfd7NtZL8cHQRZEQ6Spsa:OtOy/eY/0Ljo6PGqnDqZ/ZLW3Exa
TLSH
T101341233EFD27F32188286387053DE5C59B6108795A8F341AFA97FDB2B978816851CA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05ad996224bf0ecb21cd232070fbbd2b

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\05ad996224bf0ecb21cd232070fbbd2b
Size 596KB
SHA256 16cd03787910fec0340c58cd4efd4ba47d1f00d61395c76693cd5db695db58a4
MD5 05ad996224bf0ecb21cd232070fbbd2b
SHA1 6cdfe9d46d3269e9e6f02883db3d1d14f0183af7
SHA512 f6cea90b1282aa0ac2554cb98335a5817186ebf4327458333ba1b160918b6e37c66ff6e4966d95ca11461017171900e4b1eb5e5324ed805c32537386f5dc7e36
SSDEEP 12288:Btj29etcNztbhDOlam2l03KHsvwyjwLKqneiAKWBTd+lPINsbtrOqefzK:v2U4jDKa5K3kByjwOqePjBd+jY7K
TLSH
T110D423A413287960EAE768E78E143C0E7511DF347F0737970A9097E17C6D7EACA609E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10461fdfb35f35cca13dbe35dcf21343

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\10461fdfb35f35cca13dbe35dcf21343
Size 3.5MB
SHA256 73c9d9a9333623a070ccc1e5f6cf325d83f1ef9ce35c4d255b66a1733f6e6a91
MD5 10461fdfb35f35cca13dbe35dcf21343
SHA1 42806bf7d078a0dfeb1e462bc9e5ad6e90159b7e
SHA512 15b6bc4c957ef618f56188227bcffdbda3ab990ba80362d3fe89f97e74a01763cd46bbbace7548d5a29244dbaa842da0c7f9e449b2df715f33b708a5a629d3ab
SSDEEP 98304:LnvauOC4zP8kaSRljlFUkXqUU3aSpTMKK7d7RSktipIWcLEq:brOCuP87wlFUgU352KK79toIN
TLSH
T107063389920D485BD1FD213F4523DDB085B8315CA803CEAA28DB867C7F6A89DF13E95D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10485942eb8a27542295bc80a81acf9e

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\10485942eb8a27542295bc80a81acf9e
Size 388KB
SHA256 4efa25b9af96334f0923a13c32bb077f92316c87ab4fa057f6f581f2b6b961bc
MD5 10485942eb8a27542295bc80a81acf9e
SHA1 17dd0e6a60eb921742eb0c2b6089e47431ec8a8b
SHA512 0e93147b14f01a66be3b6555bbc5fd6563b591b5433a78a6ae7b692cf1a34bbe10bcc3bbc96bf1e6248c119538aab09e7a06987760372f41e58fb2985290082f
SSDEEP 12288:8sLlH6LvrIZgS2j/A2dZr2YCkQlkWmSBP:3t6LTIZgS2jhpQKW1P
TLSH
T1B7842374B1E82803A6FB762BD8CDACD0574809DD5B4C3E0CD43EE34A4743BCA51A925B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

114aeb78dd9a016bb99cfc455316d705

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\114aeb78dd9a016bb99cfc455316d705
Size 299KB
SHA256 17212c848e6dbf5a6707c94676af2cf66e98d13ebb74a4dee6f13e528415addd
MD5 114aeb78dd9a016bb99cfc455316d705
SHA1 b17a66e1b1f5dc2026f85ded1e4d0f31bf039356
SHA512 21a1e4aaea7d9bc766b9f2648d45be433fa6195c7558c667571cf6b0a953b62dfca8c1db82c47415b0c759f3d017fd3f5de55cf4aee417c9cb2767da5a14edd3
SSDEEP 6144:j7bhY6n1UVvdL3rfcnvGji5vlg0ZWGehBS4Tt96Ufwy:vxyrqEyvlTZDehBSbUD
TLSH
T1EA542258EC0505CAC02D967BA1978567AD990FD31E012E7F115E303EAB3F1DBB12E9A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d0390337d1a4a58e5514be1a9481ad6

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\1d0390337d1a4a58e5514be1a9481ad6
Size 2.3MB
SHA256 c79f0eeb2bca4905c585c50333db3c6f727a554f5db82e64948f93668fbc18aa
MD5 1d0390337d1a4a58e5514be1a9481ad6
SHA1 0c09b611223f335af2a42dbc371dc95ba4f18979
SHA512 382e5d7a61398d54bf15bcd928ec7755817fe92a860840efac6f6417229678cb1fd1756c5a7c82e02754a23732f63882c4a640bc6d73d28f30110d0028ae6fb8
SSDEEP 49152:DejtLQNcZOH6b3nbU/s3lgwvTS2sqQFIPg8Fb5iLcWvFXO2+xPh83+H:iJCcbz4/YlgwvLtQG4mULcz2s583Y
TLSH
T132B53399FB0A54B7BE60CE1753CF779A7F1882A510A033E7CED7ABFC1A79A404521406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

519c9c60ccc1466f23dde9aa8841ef2b

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\519c9c60ccc1466f23dde9aa8841ef2b
Size 605KB
SHA256 0834d3f12d200d30d205c016dce40e2353440e3137a92f892fb7626d8d226666
MD5 519c9c60ccc1466f23dde9aa8841ef2b
SHA1 eccc48d4f6281f2db4ca58b1b8b93345692a2334
SHA512 a3dfe1521c6d7c8cf4bea76aec1d708a3014b0117b5ecae28d98aec359ed507dc0a44191a20d12b732bb6c756ff640693d43a1f4907203b90ab79b63a073db94
SSDEEP 12288:kWoEp4kmwpJpZMqvykVpQog/BCglT0w5pKmWTXU48aUB0eFbSr12NknX6jZZc/5h:kWajwpnZfyoJMCgl4ApKmev8aUB+kXDM
TLSH
T105D4234C2E757C67E816E3B28EF0AF09C500795B4E681F4F64B6B556E7031B0AE891CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7071af81f7fad1d26ec29b7699f2d96f

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\7071af81f7fad1d26ec29b7699f2d96f
Size 5.7MB
SHA256 21f2759a5148c427118911ae402be2a2def56f29bedbd33ace3ed2ed714422fb
MD5 7071af81f7fad1d26ec29b7699f2d96f
SHA1 0b0d2efd7915cba61b677389858e4a1b3d896699
SHA512 966824925a1446316197f19616854318a76047c1a20af4bdc34f41dcec60f7a93d68f2c69578be830c886610d094df90cbb757450549daa5e7a3ac43665e0fe0
SSDEEP 98304:MPozI9K4jo9oagQ0ParlUCuJ9P3Vt3yA/owp7PcA1VyzKSpPd7ibGGg5caGctpTc:Mg94jwoalYarlrG9P3VEkx7PcHf5xiai
TLSH
T16F5633D0AA7B040AD1BFF6704C2B1F144E998299093CED4E5D25D0B989D74F763EA8AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79dbd3ce3c714af0d57119fa12ed039e

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\79dbd3ce3c714af0d57119fa12ed039e
Size 301KB
SHA256 a6e4b042d50eef0ce4711570abb41f36b947d613afda3707885418489ac663b8
MD5 79dbd3ce3c714af0d57119fa12ed039e
SHA1 d17f91544e419bb465a6c64d259897cadf205d1c
SHA512 64d70e1758cbfa2f2edf70dcc6c5bca9c4fd0a96a483ea5fda94f967a63e618b7f5537590cdeabac0af1565c900972a09d8c309f283c739cfdf62e7c7b4e757e
SSDEEP 6144:6vzbGEkFlF8j41IHH+uvUrx2lDiDWVVNydwlllgMyRWf2/10:6v/Qz8nH1vSyVLgqUMyRWt
TLSH
T1E06412FFC45644AFC172FB7B32B96D1285082C7B8206C89E6E7512B82F6B0C7571B5A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

876688a0b4b3d12b1d21ef190a5f0f63

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\876688a0b4b3d12b1d21ef190a5f0f63
Size 81KB
SHA256 0de16fc07ca5d02bba08d47e831f45ac40d4b8e28294230df31ed1d889f05f24
MD5 876688a0b4b3d12b1d21ef190a5f0f63
SHA1 5b0b93f2d10d2609a404dea770d6ef0ed478aca4
SHA512 be5d46ef07311f44d87b29e44e7ab697fb9a562ee2facc096bc6e2fb93d5c1effecd6cbeee86064fce7f06b5d23f85639b2f3d153763733831e8eced4a7dfc47
SSDEEP 1536:rvP9ZIqELBtsTZs1u++7JT32d4xA8ppYXFpfJ12+42tUES0psc506DrjHg:LP9Z3Qb6+oj2oCv2UQ0e6DPg
TLSH
T14683125DB690E4BCE54759FE88208130C8DBDF9838DF51C0ABDA7695D9C4208F2A9E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b96440edbecf358a68480d9999be093

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\8b96440edbecf358a68480d9999be093
Size 10.4MB
SHA256 3a17ce671860d8a297a23fd2ec0527c750af8603edd0e68ddc17ff4142cc19c6
MD5 8b96440edbecf358a68480d9999be093
SHA1 e791c2df50fca99264770dcb7c9ffb72655b6fa3
SHA512 c91bf1f8a72d1c696ec1af8d8d89b2a92f0e57b2641fdde3a534b66e1bb35b3269badcd5c6e4ca4002168ae65a8b9a8c17de79d24a230a26444b137f80819df7
SSDEEP 196608:7LDzwJcWPM1NufT467OkoQvDGvWVo+OPQ5XqDIhNW6cf/nmGTgAiWKMHXmmrhlQ0:7fKr4SOkoQ7+OgQWIh/u/mGTm1M3mglD
TLSH
T131B633C5EE8A0EB08DDCE987479BBF5A37510D24C056E24AEBD5B0FA404DE853C19BC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f379ec2b22ff106b837d79f7fdbf0d8

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\8f379ec2b22ff106b837d79f7fdbf0d8
Size 13.1MB
SHA256 6620658a6288e6b58b8d86aaef4e7734e10778974e9a01d364fc7aac4d35f10b
MD5 8f379ec2b22ff106b837d79f7fdbf0d8
SHA1 977223c04f192d8a157603c1f18d6d6a301e88b1
SHA512 1aa837f64e2d9652221ed5bdbf78c353e04a0536d09a3502a230b7f2f034dd404bef0e1a4ce57a42cd03f860f64965d94c2b638aa0994a3dd41fdbc6d751458d
SSDEEP 393216:DL5briJop9j7Yl/feBa5tMaNqGOGwdCUQUJ9Y2Ondq:npWJehYl/DFNDMJ+2Ondq
TLSH
T140D6339AE0F53A5B79933C7526053C970ECBF06BB59B152C24EB0452C2EDFF67401A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97327884177381d0f42d428110b4c516

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\97327884177381d0f42d428110b4c516
Size 3KB
SHA256 b8d4802f5c25d188268bf6a3a1c72a00d56a7b3f7fe64bb7f5fc4d6e8f6b8a28
MD5 97327884177381d0f42d428110b4c516
SHA1 f1486a304c7b458dcbaa53836632d723f0e87505
SHA512 9fae3ae92fe1073f7e720eb6da6ad99c19bbcdf6caad9408feff07140d5df9f845f0e5f652ae90a87185bcfb0a90287b4e0da174f1b0ea1e7055cab16baef369
TLSH
T1CB616CDD8D95121BD31F963354055E668C7FAF2AC006224F30201C2ECC0AEDF9148B7E
MD5 SHA1 SHA512 TLSH

Submit Download

a238787b4beb20bc3755a53dd2329955

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\a238787b4beb20bc3755a53dd2329955
Size 757KB
SHA256 8c7b62bf6056095c8fa839a2493cb586e420c0ede53c3d08a00e9cd6af39b6cd
MD5 a238787b4beb20bc3755a53dd2329955
SHA1 e6089ecf895148a7d102a42ef2aa1403a44b1fcc
SHA512 b40765d0502deda881c52ec1e9d2cd47b2bdf7779108aeefbff6eddf1a57a2322ca1f4605b4b51b4b2ca90a7cd229823378576af3d619c6518546b78377aeb7b
SSDEEP 12288:tMyCA48zATd7sXCwTvrJkYnZEmFwlmgHTGs4ro5pvonOM2pI2cVWf8tq/d0yW9gf:tZA8zAJAzJttFAmgH0ro5yOs2zfhPWqf
TLSH
T129F433169B6E139C88B13F925B8069E362C38FF456DDC1819F3B82D1A11D2F4C49F56B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d1f2f2e7f69f887e69e1fe71fd2c94c5

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\d1f2f2e7f69f887e69e1fe71fd2c94c5
Size 127KB
SHA256 51e2771257335c3e085d4a0f8300cd5b7672dc6f631e31c577a653b1ff9e9dd3
MD5 d1f2f2e7f69f887e69e1fe71fd2c94c5
SHA1 a0efe829a7da6d4e47c406d21e2f49378f1b0907
SHA512 7b58ee9c3dbeef24d48077a0134b456ad7335d9eefa84c1a16c0d68c96aa0f1163a4dcbbf13fd858aed116af8fd8c9d5ec71de750fb00d587f1d87f5d24f7470
SSDEEP 3072:BV2Bk7YWRsKohFyopBzW1AT3rJsYcEpv+KBXmBkSuG2:BYBqPRsnRq7Ybl+wX0k9
TLSH
T112D313783C789057E617E00621AF5233F53BC9D4A2B023D99A93D79721583F25733AA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d9500470fec2b7aaf932fb28d390514a

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\d9500470fec2b7aaf932fb28d390514a
Size 2.5MB
SHA256 5bf7264931db9d3cc89ba70c88acb7de4f3569ff7c9eb1b20a1295ef998ad921
MD5 d9500470fec2b7aaf932fb28d390514a
SHA1 a05a202c54d4b4d1f8994fb0424a86ed94a97180
SHA512 152d6a083d3d72da6da88f93da7dfbf9a0edc90b28c54eaf2f0ffc4fa37643c5c2d21f84c8525de4ff419327c8ef223ba25ef5be73b936f27db96c365263708b
SSDEEP 49152:OK+JChfrRt5Ur6cQ+IP3f5sI4FVrbOjBenUofSqjNUTa0+lN3ms/cMCvIt61:z8eR6zIkrSLof9jNUD+Xb/cMCvIto
TLSH
T1FAC533D4D9803A16D0BF3AB2A2617D0188794623E8D0DF97CB7C16F484C5ECB1BDE698
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc589dfcd63f854ad81edd0c34caa2d2

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\dc589dfcd63f854ad81edd0c34caa2d2
Size 6.6MB
SHA256 ec49efcf2d661b65ac3adf78af072fae4dd3c05cdf3fbe70c6af3a9001f2f1bb
MD5 dc589dfcd63f854ad81edd0c34caa2d2
SHA1 1003f7ddaacdf912ddd6e60e8185911050e1183d
SHA512 1bb8df2a45c5016a1e0ea58730fb74d06218856e9c0c1be1f75cac1cba9ede19175041de21306b3f1ec90440dd680339f8ad139dcca425387402f60e1edc6586
SSDEEP 196608:XRZ7Rvm4Y1p/NK3KqufSicEsnWJ9Int84ZJH9hgw:BZ7Ru71prqJE9CpXDR
TLSH
T1566633FAFEB4093ED267AB36300198526C26CF55CA14501F642A64B4EEC33979F436DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcfe8c976632c8f4ef80ed2e1876269b

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\dcfe8c976632c8f4ef80ed2e1876269b
Size 5.5MB
SHA256 96254cfd8828e3494013a6afb0f82823c51fbe6d8396a3705d8f8e4060cde0b7
MD5 dcfe8c976632c8f4ef80ed2e1876269b
SHA1 6038c50377c0389f922c5eda69f9d3cfea737f15
SHA512 8e88c1ad5d4aeeebe3bc339cd42622fdfd8d55e624cc83969373908a19e67f5357505146cb19382dd24c0e98d8ad065778598a9c43d449cfa16e4c661bd04bdc
SSDEEP 98304:N0Tdul0TFdExpV/Jc5fqP6PP58ynUTufWXMAtUcHoY4zxe4:N0gl0RYfitU6PB8iUT1VUR
TLSH
T1034612FAFF7D493DC177977992038812AC68641A9A2C650F09296C7499C3AC7DB423F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0adad30d905d932251b19b813351b77

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\e0adad30d905d932251b19b813351b77
Size 21.5MB
SHA256 c383d19d82b61423bbf0c0bf3778c71d77d64be659996f822384194dc800abac
MD5 e0adad30d905d932251b19b813351b77
SHA1 f8ad846e77f5437cabd27d2a81d3f218033752ad
SHA512 6de849afc177092c6f3f98c939bfb693867f5024d9b9d533286ca7446042509b0a6cdedbbac48b6e7a4e60b848d744e2c367aeecd10c9d0a0ce8d8c5f624a3ee
SSDEEP 393216:QMkEVcLdYDsiaN/7QruauBmTNxwxYQxXOk1na1vRGaYVALXy4NQ8ID:QtE0n/7iupwNxot71RaMAu4LM
TLSH
T15F3733ACA9CE59D35C2FD60B9E21475072022513F0E794BD67A0EB6737C3F6B9A0421E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb9dd4d0637fd6ae21747e6b6a281d21

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\eb9dd4d0637fd6ae21747e6b6a281d21
Size 459KB
SHA256 5a3aae5657899b6452004f3f43f122cb6c166c99b7261efbeb965da906626ed8
MD5 eb9dd4d0637fd6ae21747e6b6a281d21
SHA1 387c79caeee5a5a850e328f8b9ce812b5048cefd
SHA512 f9b87df46149f2fe52690e3c906ee1cfc92e3196b8db50210269312999a56b9aff354b1b5c74da192b37646dcee5305d8afde6d2c80334a484b1a8a375950b5b
SSDEEP 12288:CtpZwzl7szmrFyHHU8ibAQXgwntX3dh7ZVNx:ClGl78WKHebAKtX3D7ZVNx
TLSH
T141A4235BC725D298D9A2D17EE22215BD68FF29AD8010F52A08015E417FAE70D6FF02DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem
Size 223KB
SHA256 2eba303a7b3c87f0c52fa8f977b703ec6dea7de703f97644546d2d34e53e4cd9
MD5 2ef00fa979161001a3a5cd5169a7de48
SHA1 0d3ee6044ef954db79d4db9984cad411dfd4c3c7
SHA512 f0b7f015d3e766b390a663ca5b1498175fa241259cad73f4b8d2b9646b56bc08a698fea7f5a28324b9a59af1622296ef79d77830a50bce14fd5f02f7f9228fdb
SSDEEP 6144:EqU9NgI6FdZL52dTOgwQh1hV1AP2A2FTR:knh6fZL5mOi1hXAP+9R
TLSH
T1E624AEAACF953C4A28E3F094C9AB037ED919C3629DDAB0B31D593845C78972D61FD08D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxCrashHandler.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO8E1AC13B\RobloxCrashHandler.exe
Size 1.5MB
SHA256 c2cb63c79fae1597fc2d4043f21788ebf57a0d3da909744756a217315cb3d9c0
MD5 9f230ffbf06acc060d4bb1de1e09b529
SHA1 2af4e5319ded978d9c25a38aabb4a59b2ee39eeb
SHA512 aee6c7cb5a169cc2adcccf00998550886f9529d77ae3d7f64056bac19726004951f098b5b0e0d036888ad28ffa92bf1e11faa696c493eb05e66fa818f1568465
SSDEEP 24576:e56FgHXEL13+bjM7IVuNL1/ynrRjtZQtgB+NIlgReo36OwZi6hqjU+c3g8u2p50D:e56Fga3+bjM7IVuNL1/ynrRHQt8+NQg3
TLSH
T17F65AF4BB2E500E9C07BD174C647661BEB723408073457EF67E58AA82F63BE15A7E702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8913724486d5e3c463c493b25346ca31

Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\8913724486d5e3c463c493b25346ca31
Size 64B
SHA256 3b6acd2183d712f43aa2ecd6247ab34e0902f484ed9d2856ba7ee593e0eb7f2e
MD5 a7ad25a8343eb6d6b7b8dba67527cada
SHA1 e6f449c2ba0b39826130998997218010a69b4b00
SHA512 9e1df073494db4dd4727a37d6a4650d5f2b1dc2faa078425ef3fffcafac92295cd835d5236d55677ed3c48d2184880079e2acd297dcc9004bc65567221bb36d5
TLSH
T158A0024558020085E497F5F492D102A304A0D70A336470D3D57389856D135366F1E442
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Roblox Player.lnk

Path C:\Users\Admin\Desktop\Roblox Player.lnk
Size 1KB
SHA256 969736e4875975f7191a22dec37fd686c9fca2d27e094530afdf3da2ae7337db
MD5 aa70b4cbba85e84bd74b0e04cacd0bba
SHA1 ebc7bcb3a0c7bd7c047d9db04664606317cf9246
SHA512 53db1b59892539e6107a92379d30a313a06e2b25c2cf2b026b34a7e9eb876d6152d336ef40cb43dcbf3b95591f7709624a535a6842e7bc175a49a7e511484eca
TLSH
T1A621BE514EFA5326F2779A3169A50282E7737802BFA87E2E4085334D1B61200E89CF7F
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerInstaller.exe

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
Size 9.7MB
SHA256 6fe4e34d4140fd0dcf70dd5d489a56c3ca6b6de28fc19a6745a3d7eb030c6f90
MD5 b37da17b4c0f17be88c1a4d8ed38f779
SHA1 65f6b893ece9c5f0038ba2f3bfc08d8cd1133d38
SHA512 5659c01c11e750083d29b206ba1abc477e638920beef28f9180f7c8f148ff3c8f1d715b3e052e5afd43a776bbaaf99a69618a94a18aaf474150f3aa3ae6c8021
SSDEEP 196608:lm4L3+yKlLWA4MhfmsxfMgkjvJZ/L8Z4UrbW0:lzKhfmsx0gSvJZ/L5UfJ
TLSH
T130A6AE22F900C032E4D100B2AABD6FFA993D99341B7954D3A7D459BD59305D33B3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4484-1590-0x0000025CCDEA0000-0x0000025CCDEA1000-memory.dmp

Download

memory/4484-1579-0x0000025CCDEA0000-0x0000025CCDEA1000-memory.dmp

Download

memory/4484-1589-0x0000025CCDEA0000-0x0000025CCDEA1000-memory.dmp

Download

memory/4484-1588-0x0000025CCDEA0000-0x0000025CCDEA1000-memory.dmp

Download

memory/4484-1591-0x0000025CCDEA0000-0x0000025CCDEA1000-memory.dmp

Download

memory/4484-1580-0x0000025CCDEA0000-0x0000025CCDEA1000-memory.dmp

Download

memory/4484-1623-0x0000025CCBFF0000-0x0000025CCC199000-memory.dmp

Download

memory/4484-1615-0x0000025CCBFF0000-0x0000025CCC199000-memory.dmp

Download

memory/4484-1587-0x0000025CCDEA0000-0x0000025CCDEA1000-memory.dmp

Download

memory/4484-1605-0x0000025CCBFF0000-0x0000025CCC199000-memory.dmp

Download

memory/4484-1581-0x0000025CCDEA0000-0x0000025CCDEA1000-memory.dmp

Download

memory/4484-1586-0x0000025CCDEA0000-0x0000025CCDEA1000-memory.dmp

Download

memory/4484-1585-0x0000025CCDEA0000-0x0000025CCDEA1000-memory.dmp

Download