c21d46b067cb5f86af94d6cee1e0754fa9f15eb73c041a3ae35b4364eb0921b7

Analysis

user interaction
yes
max time kernel
900s
max time network
883s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 00:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DriftBootstrapper.exe
Size 322KB
Sample260804-asnwdsaa83
SHA256 c21d46b067cb5f86af94d6cee1e0754fa9f15eb73c041a3ae35b4364eb0921b7
MD5 33a87409c02b784366bf978f5bb3de7f
SHA1 93286cbd9c129b1fc42f1beb8380721c7602f23c
SHA512 dea1493a1d06f9be4be0b5de8404bc3a719a50970e50717c97fa567251c5f70db49b07f345de58ea35d1bfa66297c0f7f0f873cbaa61d41c130b1d62f6fe4db4
SSDEEP 6144:UvgvkNFNaxmNEJJ20n3Mbii8JmferrBYHn:UvggNaxmB0n35irn
TLSH
T14E647D12A3A8417AD2BB4778C8610941EB73781B5BA1E7CF03951CBD5EA37829F35723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
65	1672	chrome.exe

Executes dropped EXE 9 IoCs

pid	Process
3344	RobloxPlayerInstaller.exe
1708	RobloxPlayerBeta.exe
2080	RobloxPlayerBeta.exe
4708	RobloxPlayerBeta.exe
4920	RobloxPlayerBeta.exe
800	Drift.exe
2544	RobloxPlayerBeta.exe
2880	RobloxPlayerBeta.exe
3740	Drift.exe

Loads dropped DLL 3 IoCs

pid	Process
2080	RobloxPlayerBeta.exe
4920	RobloxPlayerBeta.exe
2880	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4808	GameBarPresenceWriter.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
2080	RobloxPlayerBeta.exe
2080	RobloxPlayerBeta.exe
2080	RobloxPlayerBeta.exe
4920	RobloxPlayerBeta.exe
4920	RobloxPlayerBeta.exe
4920	RobloxPlayerBeta.exe
2880	RobloxPlayerBeta.exe
2880	RobloxPlayerBeta.exe
2880	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\icons\ic-leave.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\AmaticSC-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\smallWhiteCircle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Emotes\Large\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\Help\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Vehicle\SpeedBar.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VirtualCursor\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\MicDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\InGameMenu\TouchControls\controls_phone_portrait.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\Jura-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\AvatarToolsShared\RoundedBorderLeft.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\DesignSystem\Thumbstick2Vertical.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\MenuBarIcons\HelpTab.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\TopBar\moreOn.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VR\hoverPopupLeft.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\icons\ic-info.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\avatar\compositing\CompositExtraSlot0.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\Cursors\DragDetector\HoverCursor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\scrollbuttonUp_ds.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\DesignSystem\ButtonStart.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\icons\ic-group-16x16.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\NotoSansThaiUI-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Input\SprintButtonRegular.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\LegacyRbxGui\Cinder block.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\Slider\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChatV2\navigation_pushBack.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\SelfView\SelfView_icon_indicator_on.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Scroll\scroll-middle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\Radial\BottomLeft.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\RedSpeakerLight\Unmuted80.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\graphic\gr-numbers.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\PatrickHand-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\advCursor-openedHand.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\btn_grey.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\LegacyRbxGui\M1Side.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\AvatarToolsShared\RoundedBackgroundRight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\avatar\meshes\rightarm.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\StudioSharedUI\meshes.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\LeaveGame\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\Slider\Left.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\WindControl\ArrowUp.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_11.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\ImageSet\AE\img_set_2x_2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\avatar\heads\headA.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\sky\sun.jpg	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\particles\forcefield_glow_color.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Moments\Reactions\Animated\skull.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VirtualCursor\cursorPressed.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\PlayStationController\DPadUp.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\LegacyRbxGui\PlasticBlueTop.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Moments\Reactions\fire-xsmall.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\graphic\GameDetailsBackground\abkg_general.jpg	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\icons\icon-share-game-24x24.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\shaders\shaders_d3d11.pack	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\StudioSharedUI\filter.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\TixIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\Players\FriendIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\9-slice\btn-control-sm.png	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1336	3344	WerFault.exe	123

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1672	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302770606633482"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-145f189a6a974303"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-145f189a6a974303"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-ff6341faef444107"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{5968DBD5-86F5-497A-9E24-CD694D856A0C}	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
3344	RobloxPlayerInstaller.exe
3344	RobloxPlayerInstaller.exe
2080	RobloxPlayerBeta.exe
4984	chrome.exe
4984	chrome.exe
4920	RobloxPlayerBeta.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
2880	RobloxPlayerBeta.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2012	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4544	DriftBootstrapper.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe
Token: SeCreatePagefilePrivilege	4192	chrome.exe
Token: SeShutdownPrivilege	4192	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
4192	chrome.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
468	OpenWith.exe
2012	taskmgr.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 1920	4192	chrome.exe	91
PID 4192 wrote to memory of 5352	4192	chrome.exe	92
PID 4192 wrote to memory of 5352	4192	chrome.exe	92
PID 4192 wrote to memory of 1672	4192	chrome.exe	93
PID 4192 wrote to memory of 2932	4192	chrome.exe	95
PID 4192 wrote to memory of 2932	4192	chrome.exe	95
PID 4192 wrote to memory of 4540	4192	chrome.exe	96
PID 4192 wrote to memory of 4540	4192	chrome.exe	96
PID 4192 wrote to memory of 1864	4192	chrome.exe	97
PID 4192 wrote to memory of 1864	4192	chrome.exe	97
PID 4192 wrote to memory of 2572	4192	chrome.exe	98
PID 4192 wrote to memory of 2572	4192	chrome.exe	98
PID 4192 wrote to memory of 1216	4192	chrome.exe	99
PID 4192 wrote to memory of 1216	4192	chrome.exe	99
PID 4192 wrote to memory of 3292	4192	chrome.exe	100
PID 4192 wrote to memory of 2900	4192	chrome.exe	102
PID 4192 wrote to memory of 940	4192	chrome.exe	103
PID 4192 wrote to memory of 2900	4192	chrome.exe	102
PID 4192 wrote to memory of 940	4192	chrome.exe	103
PID 4192 wrote to memory of 4568	4192	chrome.exe	104
PID 4192 wrote to memory of 4568	4192	chrome.exe	104
PID 4192 wrote to memory of 4648	4192	chrome.exe	107
PID 4192 wrote to memory of 1592	4192	chrome.exe	108
PID 4192 wrote to memory of 4648	4192	chrome.exe	107
PID 4192 wrote to memory of 1592	4192	chrome.exe	108
PID 4192 wrote to memory of 1116	4192	chrome.exe	109
PID 4192 wrote to memory of 1116	4192	chrome.exe	109
PID 4192 wrote to memory of 4868	4192	chrome.exe	110
PID 4192 wrote to memory of 4868	4192	chrome.exe	110
PID 4192 wrote to memory of 2872	4192	chrome.exe	111
PID 4192 wrote to memory of 2872	4192	chrome.exe	111
PID 4192 wrote to memory of 3308	4192	chrome.exe	112
PID 4192 wrote to memory of 3308	4192	chrome.exe	112
PID 4192 wrote to memory of 5384	4192	chrome.exe	113
PID 4192 wrote to memory of 5384	4192	chrome.exe	113
PID 4192 wrote to memory of 5324	4192	chrome.exe	114
PID 4192 wrote to memory of 5324	4192	chrome.exe	114
PID 4192 wrote to memory of 1808	4192	chrome.exe	115
PID 4192 wrote to memory of 1808	4192	chrome.exe	115
PID 4192 wrote to memory of 3004	4192	chrome.exe	116
PID 4192 wrote to memory of 3004	4192	chrome.exe	116
PID 4192 wrote to memory of 6112	4192	chrome.exe	117
PID 4192 wrote to memory of 6112	4192	chrome.exe	117
PID 4192 wrote to memory of 5304	4192	chrome.exe	118
PID 4192 wrote to memory of 5304	4192	chrome.exe	118
PID 4192 wrote to memory of 1384	4192	chrome.exe	119
PID 4192 wrote to memory of 5996	4192	chrome.exe	120
PID 4192 wrote to memory of 5840	4192	chrome.exe	121
PID 4192 wrote to memory of 2684	4192	chrome.exe	122
PID 4192 wrote to memory of 3344	4192	chrome.exe	123
PID 3344 wrote to memory of 2080	3344	RobloxPlayerInstaller.exe	127
PID 4192 wrote to memory of 4984	4192	chrome.exe	133
PID 4544 wrote to memory of 3272	4544	DriftBootstrapper.exe	138
PID 4544 wrote to memory of 800	4544	DriftBootstrapper.exe	141
PID 4192 wrote to memory of 4772	4192	chrome.exe	150
PID 4192 wrote to memory of 4772	4192	chrome.exe	150
PID 4036 wrote to memory of 4324	4036	RobloxPlayerBeta.exe	162

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\DriftBootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\DriftBootstrapper.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAEQAcgBpAGYAdAAnADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEQAcgBpAGYAdABJAG4AcwB0AGEAbABsACcAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwARAByAGkAZgB0AFMAdABhAGcAaQBuAGcAJwA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABEAHIAaQBmAHQAQgBhAGMAawB1AHAAJwA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3272
- C:\Users\Admin\AppData\Local\Drift\Drift.exe
  "C:\Users\Admin\AppData\Local\Drift\Drift.exe"
  2⤵
  - Executes dropped EXE
  PID:800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa4,0x134,0x7ffc8567c728,0x7ffc8567c734,0x7ffc8567c740
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,1175530315708160522,13087622644425378793,262144 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1544,i,14534464750952706719,17137752394956517189,524288 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,8902228305104283749,1910493201460191183,524288 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:13
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,11211915786190487038,5366082188223266366,2097152 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,13858280501581778200,4568024330391211399,2097152 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4708,i,8866609903296639730,9128433819058351139,2097152 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4904,i,8864082536314939718,5494431846906546229,524288 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
  2⤵
  PID:1216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,15852225297466562850,16354278905614023952,524288 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:3292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5524,i,11105932138581897312,17412967180567516430,2097152 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5556,i,1617558146003374704,12233640184025255345,2097152 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5836,i,17369789923993243974,12151505161810869378,2097152 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5960,i,18445755516942863027,16741292511978961815,2097152 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5596,i,16243369378638642385,12904869248872907159,2097152 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5988,i,13524165616020651730,2181617871765609795,2097152 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5728,i,11353029236722489555,7564683440940701909,2097152 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5552,i,16989093826738175733,17126186595723184836,2097152 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5736,i,13589118098249151859,2148578961881458711,2097152 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5732,i,9654059928967970247,14331811742164440978,2097152 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3744,i,2050653197640245610,18264002146923845787,524288 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3768,i,13828078648214959058,969099946377671256,524288 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:14
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3488,i,10238888318036051813,11333962514212823692,524288 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3656,i,5599600510737629815,14855043803504528605,2097152 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:9
  2⤵
  PID:6112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3512,i,16758422853655274120,7174958026350335866,2097152 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4772,i,2621923972200720112,92687695607456886,524288 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4768,i,9690495926787167732,16982076102277509869,524288 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:5996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4764,i,9096065032525533658,3303406310925917677,524288 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6376,i,4002492086049372349,1166715882082524278,524288 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:2684
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 3344
    3⤵
    - Executes dropped EXE
    PID:1708
- - C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 3344
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:2080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 1052
    3⤵
    - Program crash
    PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6060,i,16353754707049718614,8643457882087530550,262144 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4524,i,4832460464588235015,9576066336890802717,524288 --field-trial-handle=1876,i,9458742792640061643,8923749086648149451,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:14
  2⤵
  PID:4772

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3344 -ip 3344
1⤵
PID:5332

C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:4708

C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4920

C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:2544

C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4708

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5884

C:\Program Files\Google\Chrome\Application\RobloxPlayerBeta.exe
"C:\Program Files\Google\Chrome\Application\RobloxPlayerBeta.exe"
1⤵
PID:1968

C:\Program Files\Google\Chrome\Application\RobloxPlayerBeta.exe
"C:\Program Files\Google\Chrome\Application\RobloxPlayerBeta.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Program Files\Google\Chrome\Application\RobloxPlayerBeta.exe
  "C:\Program Files\Google\Chrome\Application\RobloxPlayerBeta.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa8,0x134,0x7ffc8567c728,0x7ffc8567c734,0x7ffc8567c740
  2⤵
  PID:5160
- C:\Program Files\Google\Chrome\Application\RobloxPlayerBeta.exe
  "C:\Program Files\Google\Chrome\Application\RobloxPlayerBeta.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa8,0x134,0x7ffc8567c728,0x7ffc8567c734,0x7ffc8567c740
  2⤵
  PID:4324

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:4808

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:468

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:1468

C:\Users\Admin\AppData\Local\Drift\Drift.exe
"C:\Users\Admin\AppData\Local\Drift\Drift.exe"
1⤵
- Executes dropped EXE
PID:3740

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.7MB
SHA256 a33eeac3fde1d1f99de2df08d63faa818ffdfcf2ace6a37e11bec1fe59409c5f
MD5 ad0dfa05fcbf007b1e2e535139317ae1
SHA1 8bff45114123dad46374913eac070a7255ca57df
SHA512 98e470bec6520eff7ff701d3448dff3682c39a1a9f95211595cb6fd5fde63ba26aeb79ccd32fe7adc1ab3e27d551474e41d4e56c1e2d8f01d4cfe9715c7c234b
SSDEEP 196608:ivgkZi/+KxW/hvjyysmsxP66IM5e5QIfqZzcz9P:iv3KpysmsxC6d5e5QI8G
TLSH
T17FA6AF22B900C032E8D100B296BD5FFA997D9E340B7954D3A7D41DB95A705D33B3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.dll
Size 21.2MB
SHA256 269af4ce0111e647c0a7ca5d7f1e29d769c880fd6394bf03f8a368e5c34761b8
MD5 42aa3722cc784eb50ec34b639665a129
SHA1 2cd51a6517fdd48dc01e322b7590c93712ae5fa9
SHA512 9570b27b9db7bd62f57d40f49c22fc536f58adc436cb7f818c943ab03b3839d4b9526b925d4bc0e9f9b4f440df6cfa045ecd8406f9df66048c041e328720eb3c
SSDEEP 196608:mTQLBStMScC8/lZZKPBJw5v8zOcPAhO+D9T:mT4BShEv87Eve4hOaT
TLSH
T1EF27C08EA4D20AA8C6A25071F05F46D3E662304C0D6C6DF7C6FA02603673B9D6659F7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Drift.exe

Path C:\Users\Admin\AppData\Local\Drift\Drift.exe
Size 2.7MB
SHA256 956d96f37a6f9e403334d3ed5bca1bd2fca1dcce7bac640c70d1bf82186a2580
MD5 57a303661a8b57fd68bfd282fe13749f
SHA1 381ccb392fe736ebd61525138ea3ab4e3cdd87a1
SHA512 8f191e790ec79a9f1d7f6311db980c5902ee71fb146c3f3792a6966d5dbc6cda509efbfa9c0d8f3afd75e754ecc10fd6c996d42b2869e99153e0f5588a587f3f
SSDEEP 49152:KDq+hbkW43VBMSqTonRARVviaJ8s5Od3LKvNzZ7unSPDiqmXh3S+0IpF:J+JFJaaJ8sjzZcSGl
TLSH
T191D5BF66E7AA00A8D075D0BCFD9BB917E2B134050330AAD707D08A192F6B7FD197FA51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 399fec45876641fe424603157c64a93bfa84a6d457c7744d232705c72323dae6
MD5 6c1d02cbaff738f3d6f94ec40dbcf008
SHA1 fbbd1bdb6411261370ed82572ad337196bd1b6e9
SHA512 8af560b1fdbb0124f20bafad9327711b7b9736fccee0686b5ff91af74ae58ea556cd2a9ec9178d8b558bb121c7cd6c068368dfb4df136801074042bef2e8fae4
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 336B
SHA256 7b6057ad1744ee51181e09376e37f9b886625959e1995aa6357d532125b3b895
MD5 548f3cd5fdcd987b0d939399a5040863
SHA1 4b2a58a468ba903b94a616c459551a46a77cccba
SHA512 b79613c3b1f0b2ea7174225a7e15462b57afd6d30eb59338e3e73c0846c24769ef4e28a439d91a8361f7a7f20880797a2a3d6423a210bd8ab1a1c101265f7ffd
TLSH
T1ADE0971483CF4D4DCF350230F78D7E30027681A0A28393D719F013486B8F2F40042E04
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 25883cf3252660067cbe1ab131806f4294e737736fd70fd7e8fe2830de8d5bdd
MD5 b0f91a6f42f33c728b2072e5dc5e7a7b
SHA1 af1a5944bff66221b4636a55ab5ef425a6deafea
SHA512 2345e46f802c33a933798d2e74184a6946c49e73824b6d2ac618b80729589704daf682655ee10e18fab3057b8fb3ab971c8f592c781bec96c46ea767e48fca13
SSDEEP 96:DKSoOF++CMrJ157MM0HhVjhnrylMHLAmX:DKSoOF++CMrJ157MlHhVjhnrgMHLAmX
TLSH
T144A19BF3C3E4CA6D891656F4DB256E1BCD2D0924022C3C66C8E4BE5B93F2572E21178E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 f3fec9601ef72bd265dd98185e774c3437c989fe74b191bc6327d559e175ff6b
MD5 9bc6e8e2ab1876c4e82da57eac2f7881
SHA1 c108d6c526d9ad55b142120ba11708b75488cb3b
SHA512 c1386916840c0f709cf79a14005f90ee1fec9a62eaffcfc5e66a4bf63781389d1d121cc949c1ea1254379d4aef460f993503f3d0683e7362343d5b8b197b2ee3
SSDEEP 48:YALlqjqrZq9hgOQVsJiXLsJBfoKsdhRsdC4sdjfsdqosdT7MM0Hhesdp+sdEjsdU:DKSoOFDCMrJ157MM0HhRsOjhnrylMHA
TLSH
T14BA17CF3C3E4CA6D851556F49B256E1BCE6D0924022C3C66C9E4BE1B93E2572E21178E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 05d91b72056d4af691a425d24fbdb9c33874159cfce787479f0c94cc9c9492c3
MD5 d4a1d7b6134ca1eb6ca8a261b9c110c2
SHA1 903a26f21b73a529da59c858e92d47a360651b7d
SHA512 fd16ae0e6065e295df6cdb858b75dabf61c79e6755daf7e7a11618286b1533670d38fe62099d596f7446054bf1f76aaddfe7bd1b566be74418be8e1360f39078
SSDEEP 48:YALlqvqOqXhAOk+qUhjBsJiXLsJBfoKsdhaEd7MM0HhesddjhhnONg2sdLoHUsdJ:DOhumV+z9CMaEd7MM0HhVjhnroHMbBK
TLSH
T1DEA199F383E5CA6D991156F4DA25AE1BCE6D0924032C7C72C9D4BE1B93E2572E21138E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 978e75669adff7c5ac453677fe378525c6db964695dd6967b81b50fddeb05137
MD5 8cdefd3f5c0a15f52db17c19e408cc8b
SHA1 2c6b059e04fce2647ade096d761ce352187b1db1
SHA512 3336a507d6a7e847699d2c5af354119e3cee38e522cc62ed4c75fc5e7c72c8abd9296b16169c3d13169d617ef898d28274d5078fd92277fdec785939fdc15c41
TLSH
T176819AF383E4CA6D891152F49B256E1BCE6D0A24031C3C66C8E4BE1B93F2572E21178F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 87d9c14b7ecd951f433e82c258c4b5ed625e6fd7aedbbfbb54421f690680ff51
MD5 4669793c4b7a6923185cd684f373fd0e
SHA1 bb8a12717121c0e4a9cdcc3f3d9b8f126d7ee29f
SHA512 37a8cdfdb4db3072a37c759e31126376917fdb91ef3b9abbba6a73571c0f750d8c03cf181ad21062f083f74efb7e6958b21f6350ed31bc23a40e0b554357e2bd
SSDEEP 96:DOhumF+z9CMaEd7MM0HhVjhnrylMHxmbE:DOhumF+z9CMaEd7MlHhVjhnrgMHxmbE
TLSH
T1DCA19AF383E5CA6D991156F4DA25AE1BCE2D0924032C7C7689D4BE1B93E2572E21138E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 10c3796f9e5329d64748fdad3e6b29b998a0814fd30e705b9b951b5d3d8d882d
MD5 1aaa708f1738fa2b4a9ca7f5c2714c54
SHA1 29ddf96ca758c4ff82a93e311c74847fa74ad667
SHA512 49ebac2baa505850fe838d7454d373e50bc32aee25c24e8e87e4fc8df01bca6eb26acb7127d7d626cd6b51da45f139e5f86d1288451f1352a6b9bf8cc6b1efa6
TLSH
T13021B1EBAB7EB4AB2078496F1D05BC0A5CBAE43501906CF4DF67416CF0866F30B12553
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 fb63be45829c96d3f5008729daa7fddf4fcd98f481842ad9ebe0c4623d6c2ea9
MD5 bfd801524e87a4073cda384003e85af7
SHA1 0a2a871f8e996e2e8ee62c92f5555b4cea7a4c64
SHA512 7847c6f1bf838eabfd62338a1c31acf9d5aa85727428aeaaeac7fd12d825c40c2ff2995cf8ec3da7fbd4852c7f3c21cf4f80d05a081fa050ac1e425be45162c7
SSDEEP 192:9RGmQ++Ehv7FAPRp279gHsb+WNnaw0pjeN2+7dlVyIsnAUge:9RjQLExUXcqwh0O2+5e
TLSH
T1BB32A42EBE28797B6DDAD219FA657B93D7F5102620D02E80EAFC892C11E75CC6217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4b8baed23ba6edc0bee282f22447fd3920b38f9e19bd2bfa1a0f9c73ddee82e9
MD5 71e7df78d6e8caaa18c37305416843c4
SHA1 22ee4e22f7caeadcd9e4d66d82586f070065fe1d
SHA512 e166060f1c1e6596bde852b51d67fe084e35edbaf71ceddb0c03a5341ea674358d239ffa941074c8289adb2c8e8f4affd6c7c4f4bd87df318e65403387300d8e
SSDEEP 192:9RGmAp+YVv7FdPRpukhJ9gHrjb+WNnawtEq21jeN2+7dNVyIsnAUgE:9RjAQYlPXHqlhH2S2+xE
TLSH
T1F342B52EB958697B6DDBD219FA657B63D3F5102620D02E84EBFC892C11E76CC6117007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 776ec3e0cb2ee882761478467f7cae49b51ecd355673ed026c412c6a7fc589e5
MD5 8dbb3e32a45b89a510dfef80644ce8ca
SHA1 5eb12b387879085b5167362a9589b0a108be26ad
SHA512 5d25a2eef0b5e031d37ee14d158992a72d3fd2d99fa2b2235d87bb50de9af383458af4fadd060a76f7fe7802c88fcf9e58d79621b639818e4518bcb71a635c66
SSDEEP 192:9RGmA++YVv7FdPRpukhJ9gHrjb+WNnawtEq21jeN2+7dZVyIsnAUgE:9RjALYlPXHqlhH2S2+FE
TLSH
T1C742C52EB918797B6CDBD219FA667B63D7F5102620D02E84EBFC892C11E76CC6217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 28da9ccd8400e2d05399f9d0946de92a6270f318b4770c01cfec3b73631427a1
MD5 01ff0cef306a6f62293d8b2e36c517ad
SHA1 4649fc004a6d744abadf7163fd81a4cc16e10d81
SHA512 54a7664dc596b7599e460bdc444f1801f899d87f9e3c51eaff51e6b170a6a780e0f60872652dff2381b57196e0c2edf43772fdd538e236fc8c175a74c1b693cd
SSDEEP 192:9RGmQ++Yhv7FAPRp2khJ9gHrjb+WNnawtEq2TjeN2+7dlVyIsnAUge:9RjQLYxUXfqlhH2s2+5e
TLSH
T13542B52EB928797B6DDBC219FA657B63D7F5102620D02E84EBFC892C11E76CC6117007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0e853608c83d8baa75f8af1066e7f831b01b0184abc4cd9e4bb7d5bcb3a73911
MD5 5fe5a60ad7cc45189bdb0537409d2af8
SHA1 d11a285efd4c8d0dfc97c25b88de78a196c7f5a0
SHA512 3dbeacb304f4a78b3b82f0ff0508a579243f470489f4e112f304ab4bb2a5afb17cb4a03ea7cf95242782e53f1f00bb6e55066dda717150ce714c1d403b7e4b10
SSDEEP 192:SRGXAp+YVv7mdPRpukhJ9gHrjb+WNn/iTbAEq2zDjeN2+7dNVyIsnAUgE:SRAAQYl0XHql/ybO2zc2+xE
TLSH
T1FE42D52EB9246A7B6CDBD219FA257B63D3F5103620D02E84EBFC892C11E76CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a85edaa8612e06dc2e43d0c463695f69ae9b897427ea5bd19fdc95aabd6b31e8
MD5 e3374f939f94048a7732b80c9eb04ada
SHA1 e14dae50de1351011501e87f9b8aac9f31102be1
SHA512 0302d8c3685cb5577bb5733b034da26bcc7225ec29b4359c090d71f7c4e09b550d0d8b3e153aa25a4219466d0c62ca617e1f12f70eb82fce37b31da949518276
SSDEEP 192:9RGmA++Yhv7FAPRp2khJ9gHrjb+WNnawtEq2CjeN2+7dZVyIsnAUgE:9RjALYxUXfqlhH2H2+FE
TLSH
T1E442C62EB918797B6DDBD219FA657B63D7F5102620D02E84EBFC892C11E76CC6217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7682bfa9618af8d9cd9b5b4d26ec22d4be7520679c612a49154c35f18a492b62
MD5 d8873f2c1e1c2e6996c2d07d694345d5
SHA1 213810cad43a4b3d13366b32cf79b06dd68d780a
SHA512 54abf9d41beeb2bdb75a4248ebcdb96474bfc3f0c6b0b8ef405f8a218b4c2bb5e17fdba0188a4cb3a394c2166f0e7d106b858b689b874e74779e5c7766837a85
SSDEEP 192:9RGLAp+YVv7FdPRpukhJ9gHrjb+WNnawtEq21jeN2+7dNVyIsnAUgE:9RoAQYlPXHqlhH2S2+xE
TLSH
T1E142B52EB958697B6DDBD219FA657B63D3F5102620D02E84EBFC892C11E76CC6117007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 b07b5bedf7aef186ed3a0362ea025e695ed21d79a55e702cecf655aef62da702
MD5 3c7060e1f0099311a913dba527a27745
SHA1 7bd0332c425951432e290ebb3acf0f760e00e971
SHA512 30faca0d170acf732314cd8cb15feaa4a9732acf8eff35d3168f08e8f186dd6a92a81d6d67f2a7f53c5d1257aaf800282b9db9f652a87317a3c2ccd4cda4c762
SSDEEP 192:eoj4K6jf7KxkXqK4I40pUZNCgVLHrKHfFKslE/QCXzKD/QD+ErUkKN9mjIAl53Ii:pjjIf7KxkXqKf/pUZNCgVLH2HfgsllCx
TLSH
T15F32E827A44D9A7B0FD8E44DDC126F8B6DF5419272780D2893FB9C0803A97CE115A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 63cce1a124aaa3e3de08c3f9eb7dec12cc9d1de9dcd280a95bbc7007713ef8e8
MD5 7d7bf915a6a411fb44b5f07cb34ab36c
SHA1 36dc176bde84908e5aad7353e9f23a5bd6bd55ea
SHA512 8f4189a85df9b95fb4294be31e3160f5a242749404eed7357bb3026bd9f403cfc836507fe37a4c0752da16458e42bfeba4882ffb8aa8a1a294182b47d1f475e9
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 298d80609b0cdf90250646f2e69d5a21065e47e906c60d39c9db44988b9dde44
MD5 9207ca230f0da6f71eb11a8cccdb83b0
SHA1 a7a4dec57f47de3e1a3ad927683fc224fe6a7a39
SHA512 4c2732a51449f87a73bb0b6ab96f31ddd9b57247dfa22591767068e472f826c746a452556e70d39e003859ed816069a3643e858ccac7cc195986a7c9e01147bc
TLSH
T150A0026041C20C16CD0042F075630E816752C8145A555B0394D10A5ACA6F1E64623541
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 302a18e39d345d6f4135aac2893cf8487d06ab6ceed2d00ad8c8112f9e385526
MD5 be222273a46ddc8e0f4316c97c59c174
SHA1 2b334ac0f2914e2b898a1baffe9aedc671d49026
SHA512 10253a08bfebc1d650097ba61ae3d6b0691e43ad3a46c929bd732495d2d6c560639e153a5cdb993140bcd745ad2eab7e8f13231bf61c7486063f5422adb8306b
SSDEEP 3072:0kRhKbOPmAxhKn5xYgoieCrDo6I+i0t8UemqZz:pnKCZgoCcq8Unql
TLSH
T1D9C31264DCFFED97B106C30A606E3919FFB93C9B88D979359798AF8414941DA07038A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 2c27fa800bae0edec0966d8b06a805db498ef39434ca73af8b24d55dc7de0204
MD5 b1e87da6dc15aaa5eb2e64ae5fe90699
SHA1 30472aa485f6a7b68f87cefaa5b0a12ec5db91ea
SHA512 8b2814ad70507df01347480fef18a95ec50b3d55da35a0758cdcce4ae53a94fe1a8537e2a8c51209290ab57bee27c09916510be8cadda4424b1fdfbdb1022300
SSDEEP 6144:m2ttnfJAnYKPkNS426anKCZgoCcq8Unql:myunYKw2bjxpnQql
TLSH
T1AD341376CEA7ED9B9A12C20290AF36189F35B9D78CF23D355B50AA95445C2890F038F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 a5fe4deef8a523fedee425b31e1a2c00bec17e6e2ea7cf6482d456ec536f2253
MD5 c15aa74e362ef9296606141f014fb3c4
SHA1 29fe70f13b98d6045f3beb77eff1ed1f0def1933
SHA512 2b7354eb20dd5d462f6f59322ad2b58c31bfa61b1c4fd2d1ff198ff69e99cc545649e3b1dad9526a9deb0aa8c63b7b7188884d5190c503f70053d13c4435b040
SSDEEP 3072:gKRhKbOPmAxhKn5xYgoieCrDo6I+i0t8UemqZz:pnKCZgoCcq8Unql
TLSH
T1D1C31275DCEFADD7B5138609505E3A18EFB97CAF8D9979389A48AF8404841DE07038A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 0960fdde2ed8a6547b32f3fe5b6229f2cea14b53bd29549fda98b286d5dc577c
MD5 2cdf49cb29d20f3c4542209b5635c484
SHA1 6b007e0e65e95c8058cb7eb26994f8b9efd47c15
SHA512 e588545b9484081445c5f0ef12e18ef9f6ac1e415818d94124bb6034af0b7fc88750d1b66e9faab2c70b3fbace28100036bc8d1f5980158064e9ea24b0d5e6bd
SSDEEP 3072:0eRhKbOPmAxhKn5xYgoieCrDo6I+i0t8UemqZz:pnKCZgoCcq8Unql
TLSH
T151C31274DCEFADD7B513860A505E3A18EFB97CDF8D9979389A48AF8404841DE47038A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 33f878048bba4696edefc151419a8d2ea13db4821bcf360f79edb49cbc91b647
MD5 401e8aa682eb8ce1cf8932da1da04cee
SHA1 169716d3d316b6961e78ee1f5dd3e2e81f82e415
SHA512 a9d42f065ede451e410dd67919ce2a3593a611636c34cf4b8601022c4f3b5ee1770d37d6a95a2a1f2b6c3d97e5126663ae9436a5f21295977bdea9224c3bb688
SSDEEP 3072:geRhKbOPmAxhKn5xYgoieCrDo6I+i0t8UemqZz:lnKCZgoCcq8Unql
TLSH
T1F1C31274DCEFADD7B513860A505E3A18EFB97C9F8D9979389A48AF8404841DE07038A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 5f283726847f23c4594793fd93a98dfefe5c09012f454812b06db737d76093fa
MD5 5118f7925453699c73fad4975433bd62
SHA1 964dcb8e19915d153fad4a6606922cb30fcffd2c
SHA512 dd3c418f3fc2b293df77073c8ee7e910c9e101da50ee7fc3e32eae2c265db7f7ba3c665a59b08f102e22481f29ea3c64f83711b55019109ab5a97f188f13a95e
SSDEEP 96:RC0d+OI4Q2k7i/jfTVZ9kuT5RDotok5/c6DgB6gGyvXNQyrbfyYv4a:RC0G4DkG/FZ9kGDUDfEMAQyrbfX
TLSH
T1DEA10771A46DDEB79972C448F5933A03CEA4A0AFA251AF54DEDD0E0C11FB1ED1342963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 26fe4acd9920350b7b95765b3d8b312b93e1895be6cb6fcc4dd097d45714a8ca
MD5 2c1f1044a983097d471aaa4c991a3133
SHA1 cc1a234aad6ae91e4842e6f1880866cabd27a626
SHA512 50569fca8c9b9cdcf58153709a1f70fb5b6d1ce53411ce8d8138884758f001802804382706cdde7d29012fe1b6d6e7466c0d4f861e76d14c77d9a3a59bd454a3
SSDEEP 3072:7kRhKbOPmAxhKn5xYgoieCrDo6I+i0t8UemqZz:QnKCZgoCcq8Unql
TLSH
T14DC31264DCFFED97B106C30A606E3919FFB93C9B88D979359788AF8415941DA07038A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4192_1591792658\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerInstaller.exe

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
Size 9.7MB
SHA256 6fe4e34d4140fd0dcf70dd5d489a56c3ca6b6de28fc19a6745a3d7eb030c6f90
MD5 b37da17b4c0f17be88c1a4d8ed38f779
SHA1 65f6b893ece9c5f0038ba2f3bfc08d8cd1133d38
SHA512 5659c01c11e750083d29b206ba1abc477e638920beef28f9180f7c8f148ff3c8f1d715b3e052e5afd43a776bbaaf99a69618a94a18aaf474150f3aa3ae6c8021
SSDEEP 196608:lm4L3+yKlLWA4MhfmsxfMgkjvJZ/L8Z4UrbW0:lzKhfmsx0gSvJZ/L5UfJ
TLSH
T130A6AE22F900C032E4D100B2AABD6FFA993D99341B7954D3A7D459BD59305D33B3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2012-866-0x00000274F1240000-0x00000274F1241000-memory.dmp

Download

memory/2012-864-0x00000274F1240000-0x00000274F1241000-memory.dmp

Download

memory/2012-874-0x00000274F1240000-0x00000274F1241000-memory.dmp

Download

memory/2012-875-0x00000274F1240000-0x00000274F1241000-memory.dmp

Download

memory/2012-872-0x00000274F1240000-0x00000274F1241000-memory.dmp

Download

memory/2012-873-0x00000274F1240000-0x00000274F1241000-memory.dmp

Download

memory/2012-871-0x00000274F1240000-0x00000274F1241000-memory.dmp

Download

memory/2012-870-0x00000274F1240000-0x00000274F1241000-memory.dmp

Download

memory/3272-778-0x000001B1E4DE0000-0x000001B1E4DEA000-memory.dmp

Download

memory/3272-777-0x000001B1E4D20000-0x000001B1E4DD2000-memory.dmp

Download

memory/3272-776-0x000001B1E4D00000-0x000001B1E4D1E000-memory.dmp

Download

memory/3272-773-0x000001B1E4850000-0x000001B1E4872000-memory.dmp

Download