ef4a42f9281c3483f7accba5783f131b49792e4f4072fe80641893c1a83671eb

Analysis

user interaction
yes
max time kernel
408s
max time network
409s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SolaraV3.exe
Size 18.3MB
Sample260730-dvtq7sbb22
SHA256 ef4a42f9281c3483f7accba5783f131b49792e4f4072fe80641893c1a83671eb
MD5 41525e243917ceccd85ef2765fbc8f08
SHA1 de7cfb6115fd5d12517a317142db6121f5b13884
SHA512 2bbfd376933ecf102eb74f6db6522f5248a88dccab19784a7ef3c1d016bb2581f58f7441946a4acaea62e17a5cdae0132e245dacfea77e08c5534fb7e642a6a7
SSDEEP 393216:SISSzfUJkf7eGZDfx4qy7x16j713l5wLZ/TnSFSX:SISSzfUJkf7eGZDfx4qy7x16j7BwJSW
TLSH
T18417F7217A5B99ACD09BC47483478A760A7130DB0B35B9FF44D496382F6EBF42F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
11	3200	SolaraV3.exe
138	3204	chrome.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs

pid	Process
6908	RobloxPlayerBeta.exe
6908	RobloxPlayerBeta.exe
6908	RobloxPlayerBeta.exe
6224	RobloxPlayerBeta.exe
6224	RobloxPlayerBeta.exe
6224	RobloxPlayerBeta.exe
5412	RobloxPlayerBeta.exe
5412	RobloxPlayerBeta.exe
5412	RobloxPlayerBeta.exe
5920	RobloxPlayerBeta.exe
5920	RobloxPlayerBeta.exe
5920	RobloxPlayerBeta.exe
6708	RobloxPlayerBeta.exe
6708	RobloxPlayerBeta.exe
6708	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\PlayStationController\PS4\ButtonTouchpad.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\MenuBar\icon_safety_on.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\NetworkPause\no connection.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\translations\CoreScriptLocalization.csv	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\icons\GameDetails\social\[email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Input\AimStrafeButtonPressed.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VR\buttonActive.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\ImageSet\InGameMenu\img_set_3x_1.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\PlayStationController\PS5\[email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\SpeakerLight\Unmuted40.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\graphic\gr-profile-border-36x36.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\PressStart2P-Regular.ttf	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\families\Zekton.json	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\XboxController\ButtonY.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\RedSpeakerLight\Unmuted100.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\icon_ROBUX.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\InputActionLabelPlaceholder.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\XboxController\ButtonRT.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Scroll\[email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\TopBar\coloredlogo.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\RedSpeakerDark\Unmuted20.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VR\Radial\SliceBackground.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_18.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\avatar\meshes\rightleg.mesh	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\Bangers-Regular.ttf	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\PatrickHand-Regular.ttf	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\particles\smoke_main.dds	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\StudioSharedUI\arrowSpritesheet.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\common\[email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VR\chat.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\graphic\gr-avatar [email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\PathEditor\Tangent_Handle_Selected.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\MicDark\[email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\Help\UseToolGesture.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\Radial\RadialLabel.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\graphic\rocket_icon.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaDiscussions\buttonFill.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\Settings\Help\[email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Emotes\EmotesIcon.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\models\InExperience\InExperience_checksum	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\configs\PerformanceConfigs\rofiler.tools.js	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\models\MaterialManager\sphere_model.rbxm	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\Help\AButtonLight.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\Controls\DesignSystem\ButtonR2.png	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\avatar\meshes\torso.mesh	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\BuilderExtended-Regular.otf	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller-WRQ8MK426D.exe

Drops file in Windows directory 39 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_1413005228\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_715760923\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_715760923\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_715760923\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_1413005228\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_1474385689\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_682432994\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_682432994\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_1413005228\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_1413005228\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_1413005228\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_2123195304\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_1027686805\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_1474385689\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_1474385689\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_682432994\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_682432994\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_1413005228\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_1413005228\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_682432994\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_1474385689\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_1027686805\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_682432994\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_682432994\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_1413005228\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_2123195304\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_715760923\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_1027686805\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_1474385689\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_682432994\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_1413005228\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_682432994\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_682432994\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_1413005228\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_1413005228\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_682432994\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_1413005228\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_1413005228\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2056_1413005228\Part-RU	msedgewebview2.exe

Executes dropped EXE 11 IoCs

pid	Process
1780	RobloxPlayerInstaller-WRQ8MK426D.exe
6864	RobloxPlayerBeta.exe
6908	RobloxPlayerBeta.exe
6436	RobloxPlayerBeta.exe
6224	RobloxPlayerBeta.exe
6984	RobloxPlayerBeta.exe
5412	RobloxPlayerBeta.exe
5972	RobloxPlayerBeta.exe
5920	RobloxPlayerBeta.exe
988	RobloxPlayerBeta.exe
6708	RobloxPlayerBeta.exe

Loads dropped DLL 6 IoCs

pid	Process
3200	SolaraV3.exe
6908	RobloxPlayerBeta.exe
6224	RobloxPlayerBeta.exe
5412	RobloxPlayerBeta.exe
5920	RobloxPlayerBeta.exe
6708	RobloxPlayerBeta.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SolaraV3.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller-WRQ8MK426D.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x000d00000001c5ba-188.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller-WRQ8MK426D.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3204	chrome.exe
4572	chrome.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller-WRQ8MK426D.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller-WRQ8MK426D.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller-WRQ8MK426D.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller-WRQ8MK426D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller-WRQ8MK426D.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller-WRQ8MK426D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller-WRQ8MK426D.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller-WRQ8MK426D.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298553561526304"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 39 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-WRQ8MK426D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller-WRQ8MK426D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-WRQ8MK426D.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{B83DDAA9-BFC4-4E87-BE89-83ADBFDDC325}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller-WRQ8MK426D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller-WRQ8MK426D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller-WRQ8MK426D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-ff6341faef444107"	RobloxPlayerInstaller-WRQ8MK426D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-WRQ8MK426D.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller-WRQ8MK426D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller-WRQ8MK426D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller-WRQ8MK426D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller-WRQ8MK426D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller-WRQ8MK426D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller-WRQ8MK426D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller-WRQ8MK426D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-WRQ8MK426D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-145f189a6a974303"	RobloxPlayerInstaller-WRQ8MK426D.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller-WRQ8MK426D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller-WRQ8MK426D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller-WRQ8MK426D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-145f189a6a974303"	RobloxPlayerInstaller-WRQ8MK426D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-WRQ8MK426D.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-WRQ8MK426D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller-WRQ8MK426D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-WRQ8MK426D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller-WRQ8MK426D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller-WRQ8MK426D.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{154FC61D-2904-4B0E-AF56-A65DB7D53C10}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller-WRQ8MK426D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller-WRQ8MK426D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller-WRQ8MK426D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3504	chrome.exe
3504	chrome.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe
3200	SolaraV3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
2056	msedgewebview2.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe
Token: SeShutdownPrivilege	3504	chrome.exe
Token: SeCreatePagefilePrivilege	3504	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3200	SolaraV3.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
3504	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe
6324	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 2056	3200	SolaraV3.exe	89
PID 2056 wrote to memory of 2528	2056	msedgewebview2.exe	90
PID 2056 wrote to memory of 5460	2056	msedgewebview2.exe	91
PID 2056 wrote to memory of 5460	2056	msedgewebview2.exe	91
PID 2056 wrote to memory of 5460	2056	msedgewebview2.exe	91
PID 2056 wrote to memory of 5460	2056	msedgewebview2.exe	91
PID 2056 wrote to memory of 52	2056	msedgewebview2.exe	92
PID 2056 wrote to memory of 1504	2056	msedgewebview2.exe	93
PID 2056 wrote to memory of 1504	2056	msedgewebview2.exe	93
PID 2056 wrote to memory of 1504	2056	msedgewebview2.exe	93
PID 2056 wrote to memory of 3724	2056	msedgewebview2.exe	94
PID 2056 wrote to memory of 3724	2056	msedgewebview2.exe	94
PID 2056 wrote to memory of 3724	2056	msedgewebview2.exe	94
PID 2056 wrote to memory of 3724	2056	msedgewebview2.exe	94
PID 2056 wrote to memory of 3724	2056	msedgewebview2.exe	94
PID 3504 wrote to memory of 4920	3504	chrome.exe	97
PID 3504 wrote to memory of 3204	3504	chrome.exe	98
PID 3504 wrote to memory of 4804	3504	chrome.exe	99
PID 3504 wrote to memory of 4804	3504	chrome.exe	99
PID 3504 wrote to memory of 4592	3504	chrome.exe	101
PID 3504 wrote to memory of 4592	3504	chrome.exe	101
PID 3504 wrote to memory of 2412	3504	chrome.exe	102
PID 3504 wrote to memory of 2412	3504	chrome.exe	102
PID 3504 wrote to memory of 3484	3504	chrome.exe	103
PID 3504 wrote to memory of 3484	3504	chrome.exe	103
PID 3504 wrote to memory of 6112	3504	chrome.exe	104
PID 3504 wrote to memory of 6112	3504	chrome.exe	104
PID 3504 wrote to memory of 1740	3504	chrome.exe	105
PID 3504 wrote to memory of 1740	3504	chrome.exe	105
PID 3504 wrote to memory of 5528	3504	chrome.exe	106
PID 3504 wrote to memory of 1052	3504	chrome.exe	107
PID 3504 wrote to memory of 1052	3504	chrome.exe	107
PID 3504 wrote to memory of 6076	3504	chrome.exe	108
PID 3504 wrote to memory of 6076	3504	chrome.exe	108
PID 3504 wrote to memory of 4664	3504	chrome.exe	110
PID 3504 wrote to memory of 4664	3504	chrome.exe	110
PID 3504 wrote to memory of 1292	3504	chrome.exe	113
PID 3504 wrote to memory of 5060	3504	chrome.exe	114
PID 3504 wrote to memory of 3536	3504	chrome.exe	115
PID 3504 wrote to memory of 1292	3504	chrome.exe	113
PID 3504 wrote to memory of 2936	3504	chrome.exe	116
PID 3504 wrote to memory of 5060	3504	chrome.exe	114
PID 3504 wrote to memory of 3536	3504	chrome.exe	115
PID 3504 wrote to memory of 2936	3504	chrome.exe	116
PID 3504 wrote to memory of 6376	3504	chrome.exe	118
PID 3504 wrote to memory of 6368	3504	chrome.exe	117
PID 3504 wrote to memory of 6376	3504	chrome.exe	118
PID 3504 wrote to memory of 6384	3504	chrome.exe	119
PID 3504 wrote to memory of 6368	3504	chrome.exe	117
PID 3504 wrote to memory of 6384	3504	chrome.exe	119
PID 3504 wrote to memory of 6556	3504	chrome.exe	120
PID 3504 wrote to memory of 6556	3504	chrome.exe	120
PID 3504 wrote to memory of 7068	3504	chrome.exe	121
PID 3504 wrote to memory of 7068	3504	chrome.exe	121
PID 3504 wrote to memory of 6520	3504	chrome.exe	122
PID 3504 wrote to memory of 6520	3504	chrome.exe	122
PID 3504 wrote to memory of 6532	3504	chrome.exe	123
PID 3504 wrote to memory of 6532	3504	chrome.exe	123
PID 3504 wrote to memory of 7132	3504	chrome.exe	124
PID 3504 wrote to memory of 7132	3504	chrome.exe	124
PID 3504 wrote to memory of 6328	3504	chrome.exe	125
PID 3504 wrote to memory of 6328	3504	chrome.exe	125
PID 3504 wrote to memory of 6284	3504	chrome.exe	126
PID 3504 wrote to memory of 7076	3504	chrome.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe"
1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3200.3404.13860572452131590926 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView /prefetch:4 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x198,0x19c,0x1a0,0x170,0x17c,0x7fff9e0e5fd8,0x7fff9e0e5fe4,0x7fff9e0e5ff0
    3⤵
    PID:2528
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1752,i,17704384628168525369,7318456976872663722,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2172 --field-trial-handle=1752,i,17704384628168525369,7318456976872663722,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:52
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2428 --field-trial-handle=1752,i,17704384628168525369,7318456976872663722,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:1504
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3364 --field-trial-handle=1752,i,17704384628168525369,7318456976872663722,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98 /prefetch:1
    3⤵
    PID:3724
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4672 --field-trial-handle=1752,i,17704384628168525369,7318456976872663722,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4764 --field-trial-handle=1752,i,17704384628168525369,7318456976872663722,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:2240
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4920 --field-trial-handle=1752,i,17704384628168525369,7318456976872663722,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:4112
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4308 --field-trial-handle=1752,i,17704384628168525369,7318456976872663722,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:6416
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4284 --field-trial-handle=1752,i,17704384628168525369,7318456976872663722,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:2616
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5108 --field-trial-handle=1752,i,17704384628168525369,7318456976872663722,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:6304
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=SolaraV3.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4016 --field-trial-handle=1752,i,17704384628168525369,7318456976872663722,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:2628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff9ad7c728,0x7fff9ad7c734,0x7fff9ad7c740
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,16188818904039786686,18188294713805772447,524288 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,16236955711886904227,1817408150028852895,262144 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=1804 /prefetch:2
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2300,i,523927894039491052,11015624370384277502,524288 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:13
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,14558688896826962120,14126056745727090586,2097152 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,5085116743416570517,9405558502284160521,2097152 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4700,i,11114734543025256475,16722889547760738178,2097152 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4856,i,3852791074407563954,893891556559700655,524288 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,1693013001610670163,9090048070233317893,524288 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:5528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5496,i,16803954653912683661,9356181586599921842,2097152 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5540,i,13323084893533072091,6286796312497028287,2097152 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5552,i,9240204091408334307,16788534070438891601,2097152 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5532,i,6165791754080129648,1839745270194023845,2097152 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,201499820342551279,3370005211466643038,524288 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5952,i,7364065377898903415,13947532772181028338,2097152 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5588,i,13761028764259115816,14049262530669550817,2097152 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6456,i,12523912689263138541,18286942665826619821,2097152 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:6368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5596,i,8454916078679984099,6060175401508598369,2097152 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:6376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,5245424977200798330,3790976596860731048,524288 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
  2⤵
  PID:6384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6788,i,7568103157584642358,7093677142961409007,2097152 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:6556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,6260836394745561304,3407407591099053314,524288 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
  2⤵
  PID:7068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6548,i,6832856661717444740,13496954453144491977,2097152 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:9
  2⤵
  PID:6520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6504,i,2730637003245176402,1592679982350289339,2097152 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:6532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6892,i,845453283127994897,4936170306641865925,524288 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:12
  2⤵
  PID:7132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6900,i,3158594617456389060,5841269758793359148,2097152 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:6328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6688,i,12223162432240848235,7224512559651728855,524288 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
  2⤵
  PID:6284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6692,i,5417624339488661632,3774153566266534150,524288 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:14
  2⤵
  PID:7076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6664,i,10572246208867044532,16257095614633914117,524288 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
  2⤵
  PID:6360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6728,i,9691598888289872160,17617736105834740803,524288 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
  2⤵
  - Modifies registry class
  PID:5656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7100,i,16494129713345035258,15476244647141687747,2097152 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:6912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6528,i,1807153856533664979,3295687460068027783,524288 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:14
  2⤵
  PID:6408
- C:\Users\Admin\Downloads\RobloxPlayerInstaller-WRQ8MK426D.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller-WRQ8MK426D.exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:1780
- - C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe" -personalizedToken WRQ8MK426D --deeplink https://www.roblox.com/games/95082159892680/1-Speed-Keyboard-Escape-Candy-Chocolate --webBtid 1785381771957004 --downloadSource web_game_join -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 1780
    3⤵
    - Executes dropped EXE
    PID:6864
- - C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe" -personalizedToken WRQ8MK426D --deeplink https://www.roblox.com/games/95082159892680/1-Speed-Keyboard-Escape-Candy-Chocolate --webBtid 1785381771957004 --downloadSource web_game_join -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 1780
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6764,i,9530841976653018730,15098787415011828040,262144 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:10
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=3692,i,7339110685192588791,9347160807352314283,2097152 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:x2kSClPu9lRATuR3iHRWGBG5k29VETffVoU60CfkiiuwqX5zu6nMc-QbDbuyZHmFRh5rFyjI5pE48yGmx49xM1R_ibXewRfOtI9Ss6lht0HHqSYwop7ZnGqngq8fPC3utQEQ46brvLhQQW6axKeJrsvNKWnuM8NVU9tZgmR2OK228-_9hGTPHxjgi-DjFM400Qanx1pKELe1_BOETbephCcOiTmkOsp9h13-uIU_an4Bj2NgVXKg39O80_RSbWVL39r3ERIj-wHmK2VmWZVBF-ozgCStkYLhfe8DVzai019-aoPyF12rb7H7FOnKfxEyUx2G3MGjZchsTDui5j4zwdY1zzpf_uT2vvkaHLlRVBt0CNo424Bq15I6C1gzAtwzZuSGTrmF7aAJwCYQSGwJsBZzzFZV5n_XrxK_5wApcIejBlMVrUqQnOF2tJzb2f1zkZgq6xKEb4v7inIwVxFyfABdbvwE0pXCXQn8bTf81XL2kE65z98sVtuf5-_EE2rzWsamZSnobwBXigqan6Wf4mXhIcY-jDqE-pKo_0ZQhN4+launchtime:1785381907859+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1785381771957004%26placeId%3D95082159892680%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D494ec47f-1c74-4945-9a5f-2a66e1af23bd%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1785381771957004+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  PID:6436
- C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:x2kSClPu9lRATuR3iHRWGBG5k29VETffVoU60CfkiiuwqX5zu6nMc-QbDbuyZHmFRh5rFyjI5pE48yGmx49xM1R_ibXewRfOtI9Ss6lht0HHqSYwop7ZnGqngq8fPC3utQEQ46brvLhQQW6axKeJrsvNKWnuM8NVU9tZgmR2OK228-_9hGTPHxjgi-DjFM400Qanx1pKELe1_BOETbephCcOiTmkOsp9h13-uIU_an4Bj2NgVXKg39O80_RSbWVL39r3ERIj-wHmK2VmWZVBF-ozgCStkYLhfe8DVzai019-aoPyF12rb7H7FOnKfxEyUx2G3MGjZchsTDui5j4zwdY1zzpf_uT2vvkaHLlRVBt0CNo424Bq15I6C1gzAtwzZuSGTrmF7aAJwCYQSGwJsBZzzFZV5n_XrxK_5wApcIejBlMVrUqQnOF2tJzb2f1zkZgq6xKEb4v7inIwVxFyfABdbvwE0pXCXQn8bTf81XL2kE65z98sVtuf5-_EE2rzWsamZSnobwBXigqan6Wf4mXhIcY-jDqE-pKo_0ZQhN4+launchtime:1785381907859+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1785381771957004%26placeId%3D95082159892680%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D494ec47f-1c74-4945-9a5f-2a66e1af23bd%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1785381771957004+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7104,i,1978080763146784559,11091817466542818774,524288 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=1172 /prefetch:14
  2⤵
  PID:3600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=5848,i,2877724775393676535,14280367411712678681,2097152 --field-trial-handle=1808,i,14152082579880375506,12981555228450184718,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:mtqzyPaalUwKCwwOcyLPOmxYMvEYFs2x3njdU6255CO4amCkgsAuXiiqKUUoclBRQfes1lm5FpfO28ZDCYy16oDM8NPkSEEsukEOOgR83fEKPK92apg4akCaVMMkxFKpmrm8y_IcS4GSQxV7w6bM23Z_UsDlbev1JH_jjVpOktuK4XFyaikjhJXBB5a5Bx6FjsEUC5DVjNJ1QEm1hbOqVXcC4VY693YA6m-Xpu54UHC0TZnlbwnsh14sIT6HfDWvbyy_gJaRlWhwDvW1amjDpB4tvg4qJCV22R_c4z5XGxagb7Ei8yLsNIS7X1Y6eBsZ6ZZPLxtNTxhg4O297kRRUxXSpCpEgeP-3iA_yzsw1ND7gseHydBNFwYbGlzzyqfoeUE5VN_SxPjWOev8_0GkZvLmmE3V5fVXI0RLenekPWhmnWopW4mmeR8XoOWVGbkESl_UR8reOhqJtnrmaRt5rRGtLQ0ZS1cH-cglg8mhjSfz7O6JORqARmZbStYKgCpvlIEaqBxD7vATh3LwHd1dJtRqaMTNx7Pqy4Dpzi_M_ss+launchtime:1785381952399+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1785381771957004%26placeId%3D95082159892680%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D49637ca6-36c2-46e7-a563-eac925a34911%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1785381771957004+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  PID:6984
- C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
  "C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:mtqzyPaalUwKCwwOcyLPOmxYMvEYFs2x3njdU6255CO4amCkgsAuXiiqKUUoclBRQfes1lm5FpfO28ZDCYy16oDM8NPkSEEsukEOOgR83fEKPK92apg4akCaVMMkxFKpmrm8y_IcS4GSQxV7w6bM23Z_UsDlbev1JH_jjVpOktuK4XFyaikjhJXBB5a5Bx6FjsEUC5DVjNJ1QEm1hbOqVXcC4VY693YA6m-Xpu54UHC0TZnlbwnsh14sIT6HfDWvbyy_gJaRlWhwDvW1amjDpB4tvg4qJCV22R_c4z5XGxagb7Ei8yLsNIS7X1Y6eBsZ6ZZPLxtNTxhg4O297kRRUxXSpCpEgeP-3iA_yzsw1ND7gseHydBNFwYbGlzzyqfoeUE5VN_SxPjWOev8_0GkZvLmmE3V5fVXI0RLenekPWhmnWopW4mmeR8XoOWVGbkESl_UR8reOhqJtnrmaRt5rRGtLQ0ZS1cH-cglg8mhjSfz7O6JORqARmZbStYKgCpvlIEaqBxD7vATh3LwHd1dJtRqaMTNx7Pqy4Dpzi_M_ss+launchtime:1785381952399+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1785381771957004%26placeId%3D95082159892680%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D49637ca6-36c2-46e7-a563-eac925a34911%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1785381771957004+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5412

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3448

C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:5972

C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
PID:5920

C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:988

C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
PID:6708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff9ad7c728,0x7fff9ad7c734,0x7fff9ad7c740
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,6646243673259627639,17937457054501767466,262144 --field-trial-handle=1776,i,10711154688183001976,17474757076839769961,262144 --variations-seed-version=20260729-170055.764000-production --mojo-platform-channel-handle=1772 /prefetch:2
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2120,i,6162218490852382538,16713442321781626418,524288 --field-trial-handle=1776,i,10711154688183001976,17474757076839769961,262144 --variations-seed-version=20260729-170055.764000-production --mojo-platform-channel-handle=2192 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,3884253727448547676,865405390711949356,524288 --field-trial-handle=1776,i,10711154688183001976,17474757076839769961,262144 --variations-seed-version=20260729-170055.764000-production --mojo-platform-channel-handle=2324 /prefetch:13
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,9016831723738860775,11860239004258690536,2097152 --field-trial-handle=1776,i,10711154688183001976,17474757076839769961,262144 --variations-seed-version=20260729-170055.764000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3304,i,1558210197760870686,1990333511518364150,2097152 --field-trial-handle=1776,i,10711154688183001976,17474757076839769961,262144 --variations-seed-version=20260729-170055.764000-production --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4676,i,269146274598865375,3471017405106445075,2097152 --field-trial-handle=1776,i,10711154688183001976,17474757076839769961,262144 --variations-seed-version=20260729-170055.764000-production --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:7160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5416,i,16004817484707492028,7126203587148965718,2097152 --field-trial-handle=1776,i,10711154688183001976,17474757076839769961,262144 --variations-seed-version=20260729-170055.764000-production --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,5464720465894054153,9989144643574896282,524288 --field-trial-handle=1776,i,10711154688183001976,17474757076839769961,262144 --variations-seed-version=20260729-170055.764000-production --mojo-platform-channel-handle=5576 /prefetch:14
  2⤵
  PID:6256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3288,i,6075842717979347510,12559327534042898486,2097152 --field-trial-handle=1776,i,10711154688183001976,17474757076839769961,262144 --variations-seed-version=20260729-170055.764000-production --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3708,i,17018426062897547932,8046530003819630814,2097152 --field-trial-handle=1776,i,10711154688183001976,17474757076839769961,262144 --variations-seed-version=20260729-170055.764000-production --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3288,i,7785449599031699089,9501031167032421716,2097152 --field-trial-handle=1776,i,10711154688183001976,17474757076839769961,262144 --variations-seed-version=20260729-170055.764000-production --mojo-platform-channel-handle=3736 /prefetch:1
  2⤵
  PID:6220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3572,i,9468482598153984584,15077665216134599592,2097152 --field-trial-handle=1776,i,10711154688183001976,17474757076839769961,262144 --variations-seed-version=20260729-170055.764000-production --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6060,i,612874831187702405,8494881357337979876,524288 --field-trial-handle=1776,i,10711154688183001976,17474757076839769961,262144 --variations-seed-version=20260729-170055.764000-production --mojo-platform-channel-handle=6068 /prefetch:12
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6072,i,16787227055088224260,11969345811859566278,524288 --field-trial-handle=1776,i,10711154688183001976,17474757076839769961,262144 --variations-seed-version=20260729-170055.764000-production --mojo-platform-channel-handle=6092 /prefetch:14
  2⤵
  - Modifies registry class
  PID:940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6412,i,12772007532108796678,12884115311702631320,524288 --field-trial-handle=1776,i,10711154688183001976,17474757076839769961,262144 --variations-seed-version=20260729-170055.764000-production --mojo-platform-channel-handle=6300 /prefetch:14
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6312,i,3386689028137096750,11017170134568319593,524288 --field-trial-handle=1776,i,10711154688183001976,17474757076839769961,262144 --variations-seed-version=20260729-170055.764000-production --mojo-platform-channel-handle=6316 /prefetch:14
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6328,i,12196413854840300635,9118665450725254649,524288 --field-trial-handle=1776,i,10711154688183001976,17474757076839769961,262144 --variations-seed-version=20260729-170055.764000-production --mojo-platform-channel-handle=6392 /prefetch:14
  2⤵
  PID:1260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.7MB
SHA256 a33eeac3fde1d1f99de2df08d63faa818ffdfcf2ace6a37e11bec1fe59409c5f
MD5 ad0dfa05fcbf007b1e2e535139317ae1
SHA1 8bff45114123dad46374913eac070a7255ca57df
SHA512 98e470bec6520eff7ff701d3448dff3682c39a1a9f95211595cb6fd5fde63ba26aeb79ccd32fe7adc1ab3e27d551474e41d4e56c1e2d8f01d4cfe9715c7c234b
SSDEEP 196608:ivgkZi/+KxW/hvjyysmsxP66IM5e5QIfqZzcz9P:iv3KpysmsxC6d5e5QI8G
TLSH
T17FA6AF22B900C032E8D100B296BD5FFA997D9E340B7954D3A7D41DB95A705D33B3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.dll
Size 21.2MB
SHA256 269af4ce0111e647c0a7ca5d7f1e29d769c880fd6394bf03f8a368e5c34761b8
MD5 42aa3722cc784eb50ec34b639665a129
SHA1 2cd51a6517fdd48dc01e322b7590c93712ae5fa9
SHA512 9570b27b9db7bd62f57d40f49c22fc536f58adc436cb7f818c943ab03b3839d4b9526b925d4bc0e9f9b4f440df6cfa045ecd8406f9df66048c041e328720eb3c
SSDEEP 196608:mTQLBStMScC8/lZZKPBJw5v8zOcPAhO+D9T:mT4BShEv87Eve4hOaT
TLSH
T1EF27C08EA4D20AA8C6A25071F05F46D3E662304C0D6C6DF7C6FA02603673B9D6659F7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 bcfcf1237e3e768e1ef8b21027442c00abfd18ec4c5a84382de109485147181e
MD5 e5c86e660bb257f46e9b7b9c16f78543
SHA1 794ae88bb4ebd5dc867bd60bd516d717b6f15a2c
SHA512 b59b64d78409c86d35993883d927e89d38ddbbd74c08d04fb0e9db4234c5b7957b777034c1b47b0f32bc05c5fe96e830f3aab36ad10243c1777e32f0ea496197
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 373KB
SHA256 00dcd72487112e44ba2487e5eb363a98d65f14344edef5293c8e9dd52850ee58
MD5 ad6388a08d35f6d67db1213404b7f81d
SHA1 55cb415cfa760fb4beda8422d7c635cd4caf1915
SHA512 1b92070f13725fbe34b18dce86e09ee76536ef7dd7190f2c11d54f71b91acdfd40f03c8972a85099b988fae24eaec038be967cbe7b57783340140481b9362248
SSDEEP 6144:qm2dRYZtgXkt4w9410UKjgGHjMaP8RVkqSRhP58OU5R67u4nORWO7lQ8E9:C8tg599lGDBskZP58B67znOwGQ8E9
TLSH
T1A084232C983F6900BB0252741FD6C76E4FF40988A2C0D4C28254A193F9B7EA7F5A7779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000069
Size 51KB
SHA256 bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760
MD5 588ee33c26fe83cb97ca65e3c66b2e87
SHA1 842429b803132c3e7827af42fe4dc7a66e736b37
SHA512 6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04
SSDEEP 768:VtCYamkOlFDUPktxoMggUfuuyDS2/wNsr9qdep/t0LDCzBr8VcdYM2YLx+jYRatF:/HamkonKVfM/ks9q0Nt9rnLZ4jYcx03+
TLSH
T1C83302F9E03A27AF3A55A372F131FB506455EA8C82FF4789E87DA3508EB60560F03084
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 c96f56cc25b8f90c8ca49a0a67865ec2ce32a27e5e7d29007dd30d2b76f18023
MD5 f07970e6f7555ca220d75b80ab1ea456
SHA1 dbb9d7c8c0f7bdef541698af93ff7d20fa904760
SHA512 77d36093d6c04433d1465034d91a96faa8b34cdc9184aaffe9f5c6e06c9845887f6b438e74367a4a2f9c8eb4a324063b324373bedb02a7b9d9425938a1128e60
SSDEEP 96:zJjkCJnsTdwgznCVx1X0g5PdOHpxYsIfvN9KeqaZU:zJ1JnKyhDP4DmWerO
TLSH
T136B1E90C44E5A743EFE9297C7EA14F1E1824881DCE47BFC726079832258FBE71611A28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d6de6a4344861a3e591beef7fc6370c603fbc386e7ae091866559d6e6660e2dd
MD5 88fdb53b9a3781d4f0b55d13dbb02f2b
SHA1 f6068ea415706ca08d609c048b7e3d8f7004b7df
SHA512 70bd6e4d4eb6f7d48351f453c2cdf1e8ffd05f35095d465d80c1f1c0339a1817a8aae4e225bab0e43d5d224a73164596c8cfac463cee187f74f86567cff97e6b
TLSH
T12D51092458E2A720FF7E087DBCA01C4F59506C49450BEF8B3823D867088FBF0A362719
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 705c78f9387a7e7375862a04e12c95c71f5bee9d7611381271f1fb0da8d25cb3
MD5 b732c7bf225a5db6300687249c6717af
SHA1 3c3d3c40db02c09f257df25cb37c9f5dbcb9afac
SHA512 3820f9b0ae89602a0e247d92b8fd0b25feddb4152765231d5f0e9066f96adbf0a6610a3acaca35bd843bc6ad97c3179a650a908db5a8e64a21ba3c67b608d4ff
SSDEEP 96:nQnPEOWIQT8NWw0Q13T9LwoNZoYyroVVGIZ1OhVOTlOaIjRj/PYjCv7:nIaYd73yr8vRPIjZ/PYmD
TLSH
T15FE12B0C44D09753EFF9283D7AA19F4A2974898DCD47AFCB260398B1264F7E72611B39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000004.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000004.log
Size 104KB
SHA256 9c9ade42c0d60a9d481c41facee57abeb223a058c3fa85feffef6f93cc469895
MD5 c7d93535b44e782769e3ddc971ae4f01
SHA1 f83ff2c3967e74be7d70482ba443802b1b44541f
SHA512 ac4da4699b4dc5fa0c52758af70083e9a5b6683ca4549cd6271d71e0631ffdc9694cadd1f0cafb4db7c1481cbaff82dd3f9cbc23bd629f5ffecc6f50a42c7537
SSDEEP 3072:XNyEbfT+jSUVCGz7kuc+OIdd+S+174GBql78N/IibhXk8/EMLi0kkijfRPwJRYEs:VY
TLSH
T140A36C4677808061E47584BF89D15FFB539A7B89BC52D71FAAD833BA25328D30C706A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000005.ldb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000005.ldb
Size 1KB
SHA256 5926ce1ba9d3206c2d8ba45b0bd1aebf5b06bfb64987923de69199c5e31b145b
MD5 8eb391f7b21909b1090cd305a735881f
SHA1 2affe3af2eef01683026dd35b7c6d3d39a16d04b
SHA512 75d520d3411dd9fbcf1aa2aa8cfd048fb00be679e4e64d05ff04c052f1d1eead34a59855ac5549d6623a0226bacdc657304ec4b96f67a64e6c4c2ff2e8a5b782
TLSH
T1D631A7228BDD843ED9090B3385EB42FD87F2B68576528B863670A71D0D215071DF339A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG
Size 669B
SHA256 68515261c6571cbb435508c9362cb1f7c8b2446b43f6b3706fd856cb4f0ce408
MD5 7e9b3a88fb6051fc17b092bc2cebcbcd
SHA1 09d000c00bbdd42699fefd5db718721dbf4d8dfd
SHA512 984888aad7e8901f19c62ce75c3839a17b8871bb84a2b11dcb5b81b45081fc92b5b8ee05c89276b6f2835ff60726a4c59a5ff82cd299c988ce4bf9e9bc056855
TLSH
T173017BEB86C881EE9040C1B2D7683789CA76401C96CC9FD65F86FD6E25C0808D69C5F2
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 100B
SHA256 1ee7ad6ab39795794235459599a92393bc07accc2e293eac2a67ba1a74d9488f
MD5 cb81fd236a2e956bfe972b103c31eb27
SHA1 95135d43d4b8781bd021a926d012d58ccc7572c6
SHA512 47929425224d32eba9f2b624687ebbe7972b22849847beb2a0d1a7c46f1438db37a80bdb7ee90876e3e6a292142924e25759c48996b1dec43db453621640cb35
TLSH
T1D6B0123097F11D95D0661438A4BF4184C51652607153D6552158402C0412D204D58E06
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 bc8924f07e88db13cb6ce56c46c68185167a8569984df29a07524e61c5dc1514
MD5 8d5c143f703e2adc1d6fb31715737579
SHA1 97cfdf7cff9317e4286c79263b815cbc28278976
SHA512 ab590bc27184121ea56c518b0b665fcc1fc9bf80d15ccbbd4217d5ed05f138ff063145714c8b12078b33eb5c0b70c52e9ce45cdf61ce852d207886c32a7ff1cf
SSDEEP 384:DkfDu6cpd7VLTcG82Lb655RV5/arIyhI/IdN95GMQ7mLBtlgIb0uMxRyLZJv9adm:kZwL
TLSH
T19442ABF383E8C92C991256F49B196E1BCE190A24471C3C76C9E4BE5B93E3971E21079F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 85e2eba26f6be3ee4e6ffd807dfc7eb5407e99fc100339b76d6150803add6af0
MD5 d8509925dde7bff25372459f045877c7
SHA1 dbaa1bd2ced3db3e764794eea1a06195a9cd9f33
SHA512 28e363b1988b5073bd90bb187b6a37bd00962fc3d54456f18394de41f3d44add663ce28404cf2125a0a1adda6324672d033dbde6e56a09043a23d093a3c30390
SSDEEP 192:DkfDu6cpd7IIn82Lb655RV5/arIyhI/IdNM2g9QJGjQQPsQThHHxfuLK:DkfDu6cpd7Vn82Lb655RV5/arIyhI/Ic
TLSH
T10F22BBF3C7E8CA2C890156F4AB156E1BCE1D0A24471D3D66C8E4BE5B93E2971E21478E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3270e1ca861e187c750a1fc022b2fc7bd60f13ff5bbf15bbc42eb7c0a7a2ce36
MD5 5ca69923a2bc64f6fb9ac16b6fd723dc
SHA1 0f7ced23ce25a473c56ce21e066bd0cd2acbcb5f
SHA512 3e4732d007a29035b91daa0836f53e93a20dae067ee8a4e1fbb7e39a48d46fb85c24c8251987fac79df690e17a845fe677a705fa2f161d00dd4054a42d7429f4
TLSH
T1F8319AB7C7D899BD890056F8AB156F1ACE2D0D18521C3D27C8D8AE1F57F2876E20064E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a7e431d6dde7775d82c338c7b281a78a4121abe86fcd3bdc1900aa5c2c8c1024
MD5 b6a84df6e5ada7b1289e46f9c6306cc6
SHA1 ed361395b9167f4e5d10bee9cb8dae7835636859
SHA512 a91354871b4fdecbecbd1748d022aeae8ec601d6c44f3d67fdd9cb223664c8ed02bb29438c48a493a868e80c83b2f0871513605323fe2bce8d81ea5e8c8f2f32
TLSH
T1D5319AB7C7D899BD890056F8A7156F1ACE2D0D18521C3D27C8D8AE1F57F28B6E20064E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 5e722382f874163e473e51b4420c0fab143eeaf7fdb8445d651d303d975e5b22
MD5 20022f7cfa19ca0685a343b008f4fb76
SHA1 a68bf0087dacd279f11985a8e45499f2a506834f
SHA512 fb47897328c95d25095baa4a441a9dba963c510a5cc7933060e7275ae803d37f6008bc571bffac4aeb5804bbf25f0e6df790ef43f72192c20969bc3e5edfbb9b
SSDEEP 96:hAUcQUuU3HtkU5KUPIUvJUG/UXoU1jUgbUuUG/UIhUYUZUJuJU8zowUbUIAUuYUs:hAUJUuUdkUwUPIUvJUG/UXoU1jUgbUu/
TLSH
T118B198ABD7BF745B202E18BB1E45BC0925BABC3452D26CF4CE96C17EB0859F34B11462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 06184bb295c3da5da007294e7d4c91831108df95b3abc842633a2afc9c324ad4
MD5 40d3998aabec34d522e991c2c877ee64
SHA1 70da108d7cd65cda7debc778c89c84f4805df863
SHA512 32f83ae5c72da2880bd504fbd1b79afb4bbc5f1f4d4ff40d1783f49d872b7f52a736dc3e686c7f3544a2248ceffd57a5948f460200adb77f2a9fbac13d3c3c9c
SSDEEP 192:yR1cLkoRtiv7HAPRp2H7i9UHsb+WNnn84Bu2CKeUuhVyIsnAUge:yR1cwiueXLGw8r2me
TLSH
T12242A76EAE10697B6DCBC229F9667B56E6F1102172D42E84E7FCCA1C20E75CC6317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 97e11f0fb405be84097115b385d7de3e538fba7a722590b9cecb022127716057
MD5 d9e0369777fc80df7f1160a07a0be5cd
SHA1 5c962ad79423dbb17b5e78f8d694dbbaedffc609
SHA512 ea9a47f1bd4da321c7e26163f69d062817bd5b5209df556d4c78244da31f537e86672d2176e4a4eb449a14f45a8ffd7992a9434ca6a35d188f4467c252140030
SSDEEP 192:sRncBzcLaopZNmv7zBPRpJHRUc9UHsb+WNRw7lzBXdj3kEPKeUX48yIsnAUgraJ:sRnmzce4jSZXhGwKnIEge
TLSH
T1CA62D95FAA10597B6CDBC229F961BB66E7F51022A2D46E84F6FC8E1C10E76CC6307017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3b12da31104a144c8f30fb8e5e9374e2e055f00b2b1c8eb4e920a45a344c32c0
MD5 4dbb0e22a31f175919dff109a574ea36
SHA1 db40c9291e1858df46daa6119a24afeb841f0c5b
SHA512 f0b601c3f0d9bf947f3d0d22a2c878083460c276a2eb82602a14200e187202ae40571e4f87405425c6f0a465d6e0d0c6a0111931492a47838f37d96ebf69dbc1
SSDEEP 192:yRncBzcLaoR27v77BPRpJHFec9UHsb+WNRQn84BuDtr8dKeUXh8yIsnAUgE:yRnmzcepDBXXGwZrp8DE
TLSH
T13D52C95FAA50197B6DCBC229F966BB56E7F52022A2D42E84E7FCCA1C10E75CC6307017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 127687464965256b5557d134c2afd0b1a5919580995db2a4f88bd5a04f2eb73d
MD5 c404376d1018aa32a9aeba5d42c50d10
SHA1 70d293d1a014988349ba7cb237e5087372472007
SHA512 eee8d9d27ea311b31cd6972e2651f52fd0ced98e47baff5f8f3f619e23731fe2289c23e4c3ae081fe6ea15de6ec28e5774aec6595e422f770a0d8cfd39557604
SSDEEP 192:sRncBzcLaopZNCv7zBPRpJaIRDc9UHsb+WNm07lzIyI+Xdj3kEqKeUX48yIsnAUp:sRnmzce4jOZX6GwXCQIENe
TLSH
T13962D95FAA105A7B6DDBC229F921BB66E7F11022A2D46E44F6FC8E1C10E76CC6307017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0408c16b5f241cff980fbcfc9906c1f8c8c8ab745bbca879cc00c946c96a0f7a
MD5 d6567ad1b6d03edc30ce101a824d61f3
SHA1 4354966c5ba4bfe28ca4051d9b08421004225a15
SHA512 24cfc61c5465e93b066e96a5b1728be4130e82e01f62ed5d24a73a6e41a7fde51016cb1554e5166b6697c37d8ca424bc9dff5978dbd82efdf58116adfda52daf
SSDEEP 192:yRncBzcLkoRtiv77BPRpJHFeU9UHsb+WNRQn84BuDS52CKeUXh8yIsnAUgE:yRnmzcwiuBXPGwZr42sE
TLSH
T1CC52C85EAA50197B6DCBC229F966BB56E7F51022A2D42F80E7FCCA1C20E75CC6307017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 746d27cbdfb10ca389539d458ac9b902e12c9bbc5ff8c20fc8f044979b1e344f
MD5 c9db9ae87d75b718afb1cf05d5fc195f
SHA1 91e50912c15edf7a76fae22091773a797ba10d42
SHA512 d87b37a7f29c18169012d6a9bb17597a3370126b31470be92870003c94ddfb1944caf591b7904c1573a59d6ccc03b0eae32ceda5b7fb19fbeae84e22024f0f3e
SSDEEP 192:yRncBzcLkoR2iv77BPRpJHFeU9UHsb+WNRQn84BuD9boBKeUXh8yIsnAUgE:yRnmzcwpuBXPGwZrFo3E
TLSH
T17252B95FAA50197B6DCBC229F966BB56E7F52021A2D42E84E7FCCA1C20E75CC6307017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 523ad1227fefbbc3c7a3ab3b3e40d83c163960e72ea775257b1191f09b1d74ae
MD5 2b0349e103271bc97885a2c8bbc65591
SHA1 6c4835f51679568214212af78d1b61b09a160be9
SHA512 bfee7f8d12de76d7887f1515ababdd749e7cabfeb05d3039edd237857a248b4bae725106251c933f84106ec33f8af81bd00727efe390ac345c2a9ffd9f83cb1d
SSDEEP 192:yRpcBzcLkoRtiv7HAPRp2HFek9UHsb+WNRQn84Bu2CKeUuhVyIsnAUge:yRpmzcwiueXkGwZr2me
TLSH
T1C542A66EAE50697B6DCBC229F9627B56E6F5102172D42E80E7FCCA2C10E75CC6317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5ded0c2ed8cc9cf057d671ef8de07421a533f16b9c3e65357c52b36c6b3b24cc
MD5 6e53165228473b5d3057fd54d7647d4a
SHA1 8368a93c966cf2003edc1422796d2e7d89fd8bbc
SHA512 07a6d39936cbef0e9d1b2212eb20163934381608d3d2b67da44ea6cf0bd8de7fa6dc8888e62c0ae90cb69c1fbe04632141d3d0e23fcfbcd6073c70c0c39d8c17
SSDEEP 192:yRncBzcLaoR2Bv77BPRpJHFec9UHsb+WNRQn84BuD+kWrKeUXh8yIsnAUgE:yRnmzcepRBXXGwZrZW1E
TLSH
T14A52C85FAA10597B6DCBC229F966BB56E6F11022A2D42E80E7FCCA1C20E75CC6307017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 c374091ecb44afd9057e4ad19ee1bab15b500d46a9d289cc36b6d0108fe69255
MD5 b245052e51dad3a66a2da7f9fd09ecc0
SHA1 bd47dc667345df656ddd66844a2688c29a81013c
SHA512 185ff2a08be2a5745f9b36ee72088e4fb7e1e2add9e09ff3c11c729c8bd7c50036f6c4e8e78bde8e7d67f87f524bc4757599a2655bb49fa4698a46deab4d4d7a
SSDEEP 384:oKj8P7KxkXqKf/pUZNCgVLH2HfgslxbXOD8T+ErU3miHGPSbi:oa8P7KxkXqKf/pUZNCgVLH2HfgsfDOwf
TLSH
T15D520A67688D9A3B0FD8DA4CDC177F4FACB5015676B8492492FA5C0803967CF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 2867ef1348421e6d3a83742aa37b16b0ba6220cc4a3f8d6ee73790bd903c7973
MD5 8986077acfd6cbe89e8c5482dd25d5eb
SHA1 f7e751a1220bf55e91764dec00bebd9db317c24c
SHA512 b83c116ffdae2c291e6c62bb724f76c859611bcb1c82ba331977c0ee074d1a3df5e53ea29dab5fbbf2c4194072eda4c3bd35d2c5f656d31ad005e9e55cbdd460
TLSH
T13DB0110A80A00B82C202023823C3808832AA0C2CC383C80280A802A08002322A282A08
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 3bd7e8be86f1a4efc7eb891499c440f1675073b4ad6d12ff4dcee6737c914e71
MD5 9e126d6184e247268cfa5182f6406e63
SHA1 3335c5934d370abae3b13d19f8df438552cd2b4b
SHA512 825ef0912ee5a5abf2ec65611cb6cf6bbb8ed14041c5b89c1a0dfd328f7b3ed91d16d79f0e129bbb351ee61c8459a5c7fbfaeea4f94e46f224cf61b28a62982c
TLSH
T143A0023441C41657ED10427978A16D5926568E141769C317789149848A5F2C6D111111
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2caf.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a2caf.TMP
Size 48B
SHA256 a6914c78217580ec9b96732d8ce7640b86f7ac316e35cd102558c98ad8426d75
MD5 f944723938bec20113bd0c4a2bd82d23
SHA1 00e601efb512cd6ee45ab145859b50852b15de9d
SHA512 0bb1905104198b99a3dfd0f297f1fbfc8e8299c6eedf0fac258a75410d1c744fe456e58f058bc1fec1595c2b159ba4ab196da91c0a7ccc469ff725848486466a
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

a97ffece-48a2-46e9-9f55-b281f265f1cd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a97ffece-48a2-46e9-9f55-b281f265f1cd.tmp
Size 414B
SHA256 d41d9cae0589be28aa0043ee8a34e347920e324fabee4eb70c6af2adbc67f0ea
MD5 8b5d884c1c855a4de3a34307ef6ef5ba
SHA1 c29f293fc95e40596594f51db897dc22a500fc11
SHA512 b7f4cb2ba50cf5911de303a4a8fca4095902cf9f1e0d30f2b6ce0ab816a609144e82c746cb149e32d35f2baa8527b4b711d6d126414b7208d462ef58e1992fa8
TLSH
T122E02B99CD25EC2708FD071874640707E65023675640869F7A3C81088F7463B45C686C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 148KB
SHA256 a43d302f395d785343f21f76a2641f76b3c526bfb790e086b882441218a23ce3
MD5 6888e4acac0ebb21d6c04f2c9cfca18b
SHA1 53bbd55cbd724fe115d41b11f200c23385957213
SHA512 58d55c89b00e2314e6d6c35b8b3ba99073291b1d68c6d814c3e5a9add100b8d3dcb44d0be37d9116460988bc069bfa75a507eb01e45192400776bad7554da289
SSDEEP 3072:No7cjEY/SpUN655JDCxV1BVyTtPQof81bL0JbHYDb/dPcAJL:scjE4N6JDsVJyOofGbL0KDZ0YL
TLSH
T1AFE31245DCA62E3F47AC8237A1EF825FDAF11DC78148896096C9BB051C0FAE076D7C5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 148KB
SHA256 07c36990e9df5c55c7ee513def1fa45be291dc8878ce06f1fb4a876f8e107846
MD5 bf8f13c7e354efa0789cc0464953bf41
SHA1 2efde7f1629f84a68013032036092dbc3b340afc
SHA512 7bd28f52e66cdd809d31e3ee0a2b56ad99b29669b56507dbaa2695dfe9f7b6427b410a9eab7a8e9685228dc35d95ac33999efc91c7981f987452530a2cec5410
SSDEEP 3072:Ko7cjEY/SpUN655JDCxV1BVyTtPQof81bL0JbHYDb/dPcAJL:XcjE4N6JDsVJyOofGbL0KDZ0YL
TLSH
T168E31245DCA62E3F47AC8237A1EF825FDAF11DC78148896095C9BB051C0FAE076D7C5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 cfca7d4fbb2861d7873916c64b0584156659e73d237f23808e1698d1afed295c
MD5 d738eb16b015374477f07e8ea3643fef
SHA1 d6d4417b8c878baeff88ad965b8efe6e2318a8c6
SHA512 d1c84c3f0e88c54c5e3a5e23adb04a508324b60c59e5fcd5452a16df84170cdf8ec8e4c0d13d129a85a513a28b57dd8c6eacb3f716ff37a1e648041990c8aea0
SSDEEP 3072:doSpUN655JDCxV1BVyTtPQof81bL0JbHYDb/dPcAJq:dQN6JDsVJyOofGbL0KDZ0Yq
TLSH
T162C312759C552D3F4B9CC256619F711ECEE65ECB82489878A2C81B064C0FCB0BBD389B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 5505d2a6924a949a9197ad43640117db666537181f849b912a8a3d02ceca12c3
MD5 e8899d188b43389b7ad6068518d7f184
SHA1 21c4e22e8874fda523f16d3ff61d70090c7c3565
SHA512 39ee2c42980b2f5d376ae7b654c9e7851997e74f7644b8ec308d45428c183ce99bfd73b8b738b2b73dcfb54948759b4f63991efc2898eef60672434c49264701
SSDEEP 3072:jnSpUN655JDCxV1BVyTtPQof81bL0JbHYDb/dPcAJq:jXN6JDsVJyOofGbL0KDZ0Yq
TLSH
T120C31211ECA53E3F479CC252A2AFA51ECEE608C78284897582C94B065D5FCB0B3D795F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 801de3f4380e9ecb65b141aa5b8746de759b3d5e9680628b4b37b9e26050c3bb
MD5 fbbc0177b887e32bd35bb47d397d2be9
SHA1 f075929a2f75cf999c503a3aee653bdb624e9d5d
SHA512 9323c50044250f0f8062e0af0d9fcd153cc7113e1bbe448e3b9f88a5145e5c27c3ad01d235f867dadd9acb8089f0f51b497930f1cf921ab01c0b062d520b4c28
SSDEEP 3072:V7SpUN655JDCxV1BVyTtPQof81bL0JbHYDb/dPcAJq:VrN6JDsVJyOofGbL0KDZ0Yq
TLSH
T138C312759C552D3F4B9C8256619F711ECEE65ACB82489878A2C81B0A4C0FCB0ABD785B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 dc3704cb07488998eea64361b4061154153a0a8775316e80dfdcab4968914e56
MD5 a77f57edae3ab5de70806071e5346be1
SHA1 314581389b75ac88819e1e8f7cfe81f0b7935832
SHA512 bee6c3142815bdfa0930c0d073acd36a3407861783909c95a9d553c82964fe5d1c0d211e00a60d6ba8308fb61ad967ca1d7ec726a721b3474a2d8cfa3be92c7a
SSDEEP 96:gC0d+qKJku7fby2f2eaPphrn3RDotok5R3DZB6AGyvODqLX/bjv4a:gC0AJr7fbyVlFDUDZ/kFqLX/bH
TLSH
T118A10976F4664C3B5DB6D444B5122E03CEA4A2A7B961AB64D9DD1F0C00EB4E81741117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 998b4fc69e054b738f89dee29486692f5253b307e9d1bd5fead80ad14623b6d4
MD5 441f79226fcd9719303f967dc4dcc5d0
SHA1 0d17962d046a703321acb046c23d24090cf2d72a
SHA512 eb391854c273d6a1f33472cfbaa800e9ec1f4cc97860bc4bf2d7eb5f9707b8cc86deb3e69979dafb338f31aa7803ca3840045fee01e9ebeed8722fcca5d9fe7e
SSDEEP 3072:auSpUN655JDCxV1BVyTtPQof81bL0JbHYDb/dPcAJq:aKN6JDsVJyOofGbL0KDZ0Yq
TLSH
T17FC31275AC552D3F4B9CC256619F711ECEE65ACBC2489878A2C81B065C0FCB0BBD784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 48d3d2962bdf65549d958f68d655381b526560c2e5c1fffee0986b259db677c7
MD5 c22c343468b1a29b3bd392f5985db70f
SHA1 ffb4caea6dbba5cb8bfcd19a992e5f9d027dfad0
SHA512 24cb6c4baaf1fc54b7702935e29dab571374fb533a4098f6ea544e718c312ab9ffe67e349c2af4e0e1e3f09b1df211718405adff2d6d1d651a3481dad2ab12b0
SSDEEP 3072:mnSpUN655JDCxV1BVyTtPQof81bL0JbHYDb/dPcAJq:mXN6JDsVJyOofGbL0KDZ0Yq
TLSH
T11DC31211ECA53E3F479CC252A2AFA51EDEE608C78284897482C94B065C5FCB0B3D395F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 2d8641d08108fa3b87a976c64e520f173db07000ab250374075368e07460c3b3
MD5 ce2bb731262e564cb857fd8e2e80127e
SHA1 1b1e72e645e4f83aebaf4462e0132656c48623d2
SHA512 5c3b7285ed247acea98247845997c8be2b6ece390ead182da142f7f96d9554d82e7675e7ba13a120678ca4230fd856e7f3e7d24be2bbd9760899edfb22a8abd7
SSDEEP 3072:yuSpUN655JDCxV1BVyTtPQof81bL0JbHYDb/dPcAJq:yKN6JDsVJyOofGbL0KDZ0Yq
TLSH
T1D8C31275AC552D3F4B9CC256619F711ECEE65ACBC2489878A2C81B065C0FCB0BBD784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\DEBUG.txt
Size 206B
SHA256 adc95c3dd3a9654392d9ea271db5dc4f157fc394e5d5bb3c163ed73d54009df2
MD5 9903464579dcccbb57ce837e9b45f7fd
SHA1 e70f0700043364bfb54532723ce514d140d07eba
SHA512 7ecc72389d8ab3b1364e782184a7637dba4c637f6caa1e16f28accea80941548e212687930e75447bf4198c9a6aa38f649fa93ff9b990d2472c20e66e9542db0
TLSH
T1D6D0E954A36CB0E2511665425F503E9D96D5F4471C880CFC6B5A690E7794813DDDF902
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 592B
SHA256 2ef408107f276fad3a22886cec744c27621036ba3eaf1cf234655ae2b6510542
MD5 eb17851f886bd6142e46da08c4386284
SHA1 f1147538a2859c1c18aa088c961e2e35b19624b3
SHA512 07922e3f42211a5d6513c7f0dc83117dc9c52edbd5128a4797d58f4fd8bb568fa4cb6343cf0e3d9dcf309a0781b623ed79be8cc3789ea508a0c5c1eef8bedc32
TLSH
T11BF06DC49C6A72E7098284528B291C9EC8E8B0173E725AE85A317F48774481BED8F72C
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 1KB
SHA256 4c94b456f85303bbc1fc4e30530b7d03ef1eadc42ab4990f0107432726dc5a7e
MD5 2d868dde9d2b3601fc4d89c230d56012
SHA1 34365eaddd350d4fdcc4c9bcccee457d61e1f1bb
SHA512 040c19716ea01eaf9bca4fd31b3397c183b6823e13d60d23480c56dce4decd6db9d115face31a2e6e9444889050ab80c737f010976de747d9467aef4fe9e8784
TLSH
T1DB31C1859C69B6E604A0E145CF541DAFC8E9F40B3E6049AC5F71298CB751C0BECAFA3D
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 2KB
SHA256 ac354843fa6c64b994ef8c0df9239b2019c36e0c0b338bb8c0137ec5ebd0d2e9
MD5 846214e47441556b8738385ac6b45ea6
SHA1 5fd024d991b3ab125ab5ce585ede9f0e8354977c
SHA512 686f08001616beaa4e0b123cb83831609eb52269315d8cadea2b3f1077d02f33b981f68bfc77dcbbc7bd21d5def78ab24a7249b62693e315ab9d452848f1a81e
TLSH
T10C41F5C59D6AF1E208A09046CB480DAFC4E9F41B3E6099AC9E71299C7751C0BEC9F73D
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 3KB
SHA256 02e98bff53df981a8977360b9dafdb76e7108a4263d83143d763f04324d7e654
MD5 9128ce2217671b726807978a1c7998cd
SHA1 d9a207a88f39eecc48ea1294f0436b15cea915c7
SHA512 744a7a40b57557fc32d778b4793ebca42c5295831aed7e2862a73c1342be69dfeae65c7404f70fb4edccf92b6171e05d2442e4b4c06a94f431aa6d3f0a16b85f
TLSH
T18A7137C0987AB5E708A09006CB581D9FC4B9B4077E609DACAE70399C7785C07EC6F72D
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 4KB
SHA256 79221eff1b6d75cb1b6e40e372993e67adbca518b59d80741a2426cfb3376157
MD5 8bd964553f7e7aaa0adc6cda45c3eddf
SHA1 66b0179a333acb5fbed97fd88693c68fff8121a4
SHA512 87a242f8f5ecaac2bee8d392aa5c7ea6f48dc47734bfecb95c93cb9e5f9d13eaf2bffbe2c09342fa2c7aaa28d3982875832a956619561d16fa100fca012b71f4
SSDEEP 96:ouny+ODipN0i3fbEr1+BEkyFijuV1uP1/Nn7baBCzpwIs:xnySpN06TErrin1/Neovs
TLSH
T13F9135C0986AB5E709A1C041CF591D9FC0A9B4177EA08DACAE71399C7394C17ECAF72D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SolaraV3.dll

Path C:\Users\Admin\AppData\Local\Temp\bin\dll\SolaraV3.dll
Size 14.0MB
SHA256 145737d2398655e2db2aa0a880817b61af5123bd283ef8f7829cf7cce86ffca3
MD5 72b21f45bd0fc5e8c766f909da064f64
SHA1 f7fb04476eef467e90b14482620edb1f4402abef
SHA512 c5d758e6c309ce51baaeeb0ca7b46109836ede2534b0a481fc4129bced70bbd81a5bc7f4635d80edcdae5e8155e4f7b1c429cff3b70898958887d6df8e0a97d4
SSDEEP 393216:V5ArB1JKRvjSzZBToFbaieiTA3cy6nidzdK:VOAveTLiv
TLSH
T144E68CD620E461ECC426C5B9C743EA3BC66F74390329D6DB56A492A50F23ED1367BF02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3504_290073743\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 02b8bca891d0f07403a4bc2789e0fd792a216168b8b80a0ae2ed41af8fc8383e
MD5 131f44b7bebe14155eb4992a3f7d9389
SHA1 fd7774e892bd5927dada312f3f911ffc15d36a15
SHA512 3c9ab1a6be61ab9b3d85fc0b4ed8be7cbc81f1ed0c74d786bcabb37b5c18c488c0deae3f6598da0db731365d573bfdf7c32eb06623fb8bf57fd6740bc86460c1
TLSH
T18BD0123A7B010178C05024730042770A0400C58F44095004B428DA1E6A040D01D06482
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c1f2e408432fb00656e8e56e0711508669c075d40c4d5c9b95c9c4a9143b4fb7
MD5 85099145c5ff455d716648eb29e5544d
SHA1 c53beb148797301836129aea4cd3fc60c79674e7
SHA512 317ed382ac49b7dd93fa70b5ce98590541bea74e20d7a3a26d3a95f0462601e635532ec5269ea44c59821a13e415c5701114932293fa74fcf59a0465493d4447
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

852f736e-a329-4fda-bcc6-b51d696a40c9.tmp

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\852f736e-a329-4fda-bcc6-b51d696a40c9.tmp
Size 6KB
SHA256 f2ef307ad491d1b12ab3461182b68f547eb05d9d141f3b1bc384bfd623943e91
MD5 e43c79aed50c33b64767232160540d02
SHA1 22079a38b8c079d2f2bcdcdec5b2967728de0be8
SHA512 10567fa0d97808e2218b025c77d252c2ef69e891ab5aa1e1a58be6cbdad88956165e4452d62a2d98d368e9b33832aff55d28d284e661a3bd3770c4de8da169b2
SSDEEP 96:stm/dzxq3Tb9ok+mBo5h16Z0us7/x+6MhmuecJxu1ejeLK+gSpB28XM1C7K:stepqqionusV+FdxuQjh0BG6K
TLSH
T1AED1A7065E24697B4CC6E609BA357E13E2F56072B1D13E48EBF8861C04DB6DD6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 9e9a7a9707ffbf98b5e29b4c0cb8f8fb20f409c4cf9e2499fa4b465e95f35548
MD5 063216bf1ae39d27ab06994eaddf06ea
SHA1 7bb5c2f2241123434b300467c5d6f157338450f8
SHA512 b0eba0717346cebaa5d956bd6ded555dc1cde6a47e847b0c94ec13d8ca245e5235fd6c8343154886170a568e2e6ed54adeafaf0ed10e445e01eace2705c1f472
TLSH
T1DAD08C1052C55B18CF413A7E22CB0FC230F4962D42430FD3199BD43465CF38083854B8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d4cb.TMP

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59d4cb.TMP
Size 48B
SHA256 2a5aca7597f7deb209ab997f7eeffebcb8ff71ea7832a5d684e722b78517a039
MD5 1661c7df6b21e02aa7c5f70ee8d7f342
SHA1 7667504cd4acdc8f81006836ea75ac78a83d2272
SHA512 3ed821ac08e0b322052ee39d6953ec77ac40280118e0b20ab03714e5012469b4f2121fd7bfebd318c2dfbecc743aa0c057265e7c0f5aced69f4cb6fae54eea12
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 03977d44f2096072911b365de72f78f9f70410eb4f5e4689d591a2e55ba8cf51
MD5 84458a90e90f9d725221bcdce5a450bc
SHA1 9b7bf6742cc16e2ef04b5b2d59643a3c493f1bbd
SHA512 03eddbded71520d0bd43b97feb9fc8de77ae8733abfca43027e8f6a0bcc1ddb2047f1eaa7dc53aa63d68b338a023709a7fa66f907186fced0fd843c9854d2e19
TLSH
T15C31A3A6C7F4C67D8A5166E027307817CD2D0518A2247E2BCEDBFBA657D10B1F21160B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Preferences
Size 6KB
SHA256 90a1c624f3e8702d8eed92ddb6761fd9511792e89ea1b18c56fa83c5e98a6ca1
MD5 5bebc20c6f6f49005d3185c3f5084d40
SHA1 d222f37542240ab00dd1e9a9c1a1c4eab2e5da7a
SHA512 92c94b085c563a48edcfc7b74286cd9528ec3028bed525fe40cc9747b47a60e4ed3b9691248d86d8d384f68b5ae30627e2d8e9c1d6e5b3d369a6aa2da13d58dd
SSDEEP 96:stm/dzxxG3Tb9ok+mBo5h16Z0us7/x+6MhmuecJxu1ejeLK+gxIB28XM1C7K:stepQqionusV+FdxuQjhQBG6K
TLSH
T1ABD1A7065E24697B8CC7E619BA397F53E2F56072A5E03E48E7F8861C04DB6DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 14KB
SHA256 aa3b4cd2749d80b66994cfb10ae65f7bce88dc523c34ff404244cecf8764ce2a
MD5 25ed263f302545c1419e027e2a02aede
SHA1 de0241a9ef8eb7d7ed99e27595b949494835fdb4
SHA512 7cb7753c363a0c8a57d45ac46c31b619a6780b6869987047cb243a7e8d0b6efdc9cf2cd9faf453ffa7fe0bfadd1ec768a5a6d042eedc8431e0306c28fc034ff4
SSDEEP 192:JDFOKH/2/aQWjYhwZ00i+z/kNWIU6ZwNj1Jfo/iVQ45hgj4kPNBS9/jEeoDUhyYX:5+aQikB+z/xvxjg/qhEbNBSS5Wdx9z/
TLSH
T164628E2B69797D3695F3EA0479590B4BDBB89872D1C27EB88AFD5F0C06C73980342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 15KB
SHA256 55536248d99ed52255da91b581093726597682f6758cc2554042c4b903681b52
MD5 fc6c60361e3b030ac66ca61c3a14cb8d
SHA1 e9d2cd8c6393ccb2ac92c6065da66ea0990a834e
SHA512 84ed61d6a4f2ec01c6eab5a0a0f65be80040142bca6dd9cb1ddcb84cffe98193033d52faf7d411cfe94dc442365030903fc19b36f0e0f6e5f1873c10f52b3695
SSDEEP 384:T+aQikB+z/xvxjg/qhEjNls5WDhmOCx9z/:y/UxvxjgC+0lOCxF/
TLSH
T18B729F3BD964AE27A8F3E641354A6B9BDBF4446291C16AE8CDED5F0C06C33DD0346C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 15KB
SHA256 52060fea34bfca001621a21aca461d6d5dee47a05340adb21e337efae6b2244c
MD5 951cef21b42c662d865fc1e853de45df
SHA1 15ca8d22da9a71c0aa36d59b7e71545323084c70
SHA512 2996f0d0f930811ab2ae33389b6d127e2a61f705acf1019fec51f40efd72bee34152221361eee08ec5b2dda7d3e9d2713bfd49e00ca58b14eb735f341ab83568
SSDEEP 384:G+aQikB+z/xvxjg/qhEbNlP5WDhmOCx9z/:R/UxvxjgC+BlOCxF/
TLSH
T1C6729F3AD968AE27A8F3E640354A6B9BDBF4447291C16AE8CDED5F0C06C33DD0346C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 3KB
SHA256 2c3fa276a8d8ee5cdee320e3b0025e7fe00e4ea869a82161a449fd2c0c92efa5
MD5 cdcb9780d18d49d675b1275692c7f842
SHA1 2a733c62137ecd9b754ff7ff7d0678ee434e267f
SHA512 1aa588d19488cee13918eac01673b2bf1e1900406acad0450609eafd0e2f0b9fba7fb25c17584bf2232614bc39d6d75d697f636d00b9905b00228b85a6cf4bda
TLSH
T11871853B6974A9775DF3DA05B8862F03ABA55073E6917F95CAEC4F0C01DB2891382C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 2KB
SHA256 d522f6bed97b0f3d699865f1aaf9ef3681a6dc0cbe998804df45701966414eb9
MD5 7fb12470332558b97f67ed1e29f0278d
SHA1 980e6922f5e5c2437dc5a97b0b01c444f60407c5
SHA512 18f12d232a4baa5cebc80d1a17339fc4fb8bb2ea725e54426b437590dd33deedd0c9d2f20c58501d2c88b782b041393f4f244f43b4bc2a4f041e9423ff9a898d
TLSH
T16351B2737A249B36A8F38A44784B2F239E755062EB623F50DADC4B0C01DA15D2386C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 3KB
SHA256 8ff3bdd6af761f76a4a5f3441e744a0971dd69ebf3228c13a8fbe723ba86f8d0
MD5 9ad41e6428139f2ea0aeef04a55892e2
SHA1 e433b0bdfcab890e49ec77aa4fdaef45bff56937
SHA512 6d420523fb94b35a95a5e5eb5943cc36e14cd624844cd8486706295e761405a5e9a86b96b746940e745f5e721b703bf09b0799e0bd10e63fe09353c4d65a6b09
TLSH
T1B661867B7A749A379DF39A04B8862F16ABA55033E6917F95D6EC0F0C01D72981382C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 16KB
SHA256 64dce3a8e71213a64e4b82741b1ff0004679a3fea8999c85a8bda5adc65115a2
MD5 973184d067cd9a751161c1b568346fe6
SHA1 7a2781b7e47db187d3200332d143f67b2dbea663
SHA512 97c4c51589485d373b731b7bb52f3390f7d3dd9fd21b07722d8a586bf05087459a8dfb8f0bfd44055245c0762e37ac0188e7e98564182a975a7b65be75f79bd0
SSDEEP 384:C+aQikB+z/xvxjg/qhEXNlv5Wq4mOCx9z/:t/UxvxjgC+1tOCxF/
TLSH
T163729F3BD965AE27A8F3EA40354A6B9BCBF4446291C16AE8CDED5F0C06C73DD0346C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe596920.TMP

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State~RFe596920.TMP
Size 1KB
SHA256 8252e92b5a5aef9e217f294ac9a07b3d21ce6ca7b3660e8884152067ac6e3f07
MD5 3495cc7011b7e7dbb82b705cc032db9e
SHA1 1cb9931748e114e67032bf40bde2ef470975cfcf
SHA512 99aab6afc8ac11073f4abcd003213d3a25d2523335ed620ae12eb948885345c499cc4fc435e61744d915784e4f73e504f53a05640f0d74cd4c5009d702e7ed6e
TLSH
T15F2142B7B6A44F71BCE2668570476E175EA11077C211AE40E2CECA0C02AA08D975BC37
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

RobloxPlayerInstaller-WRQ8MK426D.exe

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller-WRQ8MK426D.exe
Size 9.7MB
SHA256 6fe4e34d4140fd0dcf70dd5d489a56c3ca6b6de28fc19a6745a3d7eb030c6f90
MD5 b37da17b4c0f17be88c1a4d8ed38f779
SHA1 65f6b893ece9c5f0038ba2f3bfc08d8cd1133d38
SHA512 5659c01c11e750083d29b206ba1abc477e638920beef28f9180f7c8f148ff3c8f1d715b3e052e5afd43a776bbaaf99a69618a94a18aaf474150f3aa3ae6c8021
SSDEEP 196608:lm4L3+yKlLWA4MhfmsxfMgkjvJZ/L8Z4UrbW0:lzKhfmsx0gSvJZ/L5UfJ
TLSH
T130A6AE22F900C032E4D100B2AABD6FFA993D99341B7954D3A7D459BD59305D33B3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2068-1281-0x00007FFFC00B0000-0x00007FFFC00B1000-memory.dmp

Download

memory/2068-1280-0x00007FFFC0330000-0x00007FFFC0331000-memory.dmp

Download

memory/3200-2010-0x00007FFF9AD90000-0x00007FFF9BBA7000-memory.dmp

Download

memory/3200-240-0x00007FFF9AD90000-0x00007FFF9BBA7000-memory.dmp

Download

memory/3724-294-0x000002294F6C0000-0x000002294F7D6000-memory.dmp

Download

memory/3724-88-0x00007FFFBFA40000-0x00007FFFBFA41000-memory.dmp

Download

memory/4112-2267-0x000001C156AF0000-0x000001C156AF1000-memory.dmp

Download

memory/4112-2260-0x000001C156AF0000-0x000001C156AF1000-memory.dmp

Download

memory/4112-2262-0x000001C156AF0000-0x000001C156AF1000-memory.dmp

Download

memory/4112-2270-0x000001C156AF0000-0x000001C156AF1000-memory.dmp

Download

memory/4112-2269-0x000001C156AF0000-0x000001C156AF1000-memory.dmp

Download

memory/4112-2268-0x000001C156AF0000-0x000001C156AF1000-memory.dmp

Download

memory/4112-2271-0x000001C156AF0000-0x000001C156AF1000-memory.dmp

Download

memory/4112-2266-0x000001C156AF0000-0x000001C156AF1000-memory.dmp

Download

memory/5460-1186-0x00000288A0280000-0x00000288A0396000-memory.dmp

Download

memory/5460-289-0x00000288A0280000-0x00000288A0396000-memory.dmp

Download

memory/5460-2361-0x00000288A0280000-0x00000288A0396000-memory.dmp

Download

memory/5460-781-0x00000288A0280000-0x00000288A0396000-memory.dmp

Download

memory/5460-22-0x00007FFFBFA40000-0x00007FFFBFA41000-memory.dmp

Download