animateclipper | fdfd0b06cb31d68146dbb5ffb45b82ca1b59a7b4f62f917a990a9c3bd01654ab

Resubmissions

04/08/2026, 03:17

260804-ds37vsfl4s10

31/07/2026, 15:40

260731-s4g64axtfx10

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 03:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fdfd0b06cb31d68146dbb5ffb45b82ca1b59a7b4f62f917a990a9c3bd01654ab.exe
Size 15.0MB
Sample260804-ds37vsfl4s
SHA256 fdfd0b06cb31d68146dbb5ffb45b82ca1b59a7b4f62f917a990a9c3bd01654ab
MD5 44fb96375157c4149dca4758fc552999
SHA1 bf63a98db3c3b5c7921e12219af0bd002ed8abaf
SHA512 bba296353f5d56bb4ec3368bc7c7e0ef7f56c3b5fd20d385e9e6f120e200944df5b9c89cccf0cd954fe34b3a48e18681d5f8e06498cbf95fc5e8e4277abb5500
SSDEEP 24576:nY6TYOe2pP1y2DjTHcmQhPT+mP82giMYRu8XEtN5Fs9:nY6TYOEmQB+mmKzUtN09
TLSH
T19CF67B15A3A356E8D2268177CA96CE32F7B578410760AACF0E54D3192E37AD47E3E313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware clipper defense_evasion discovery animateclipper persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

animateclipper

bsc.blockrazor.xyz

Mutex

update-S-2-5-26-24247216-2331352693-3112950123

Wallets

0x8C9C95A830b7E7e86f2f12DB88e911499A6f695f
1MuxHw4UUTsGtrYPa648xU822QEnCa7Hdq
3CPNSyRZWCpe2RMZ8ZysPkjcJAQJErecTZ
4x5U5QpXi4pNnDK9hpmZnV1gYNw78Ns1NWn5KtK5sksc
DBwmTibJfzs4nSnpDDsEjfmYqK3MUJDAfy
JZQCYTRBUGZR6TD6BLJXMB2ZYXI72CKFYPFGD5MP7K6FFV4XQ6QUFCRNEQ
LLSz2i1z6cjdqP34P6n78fCmpEoNAXFEu6
MWYxRmLZctVa7QcgiWemXGpvWc4drZBEPj
RSqNyaTeGjdbe8541bLG4UWU3jzx9oFGaj
TPtJCKJJDbLLPE7Mo9CZHw9RVWKV1hXcJJ
UQBEMPCcI_zn2UlBL-7r42fMHr6idU5ph9A_PbQP5lyRSCtd
XnbXJUXVRHXP6ejoieGzReP9GTFGvtkEjG
bc1phpyljll0vkjaukl33mmxfgcn030fe3rr3kt3lx9tvel7pap72rcsg5shm0
bc1qjmmnmjl54c8fzv8s4uvfsklgxe5hwe94kqaxh2
cosmos1tddarrjtgstsnutx9qpamsfjkpjjq52arpxklr
ltc1q3h79hhtvg0h66wyd9cjy20mzcwjdkcfj60cshz
qr6ca92nljwal2gct7wy2cjcnr7ksxmtwggt2ryz9y
rhFkjpX2kAUVSGGh9ZvGUYsyYMhSgUz14z

Attributes

auth_token
91c5546b-f7c7-40aa-833d-515aa2cb49f6
contract
0x6936edc505501EBB2F202C985a021a06f1c10C9E
headers
Authorization: 91c5546b-f7c7-40aa-833d-515aa2cb49f6

Content-Type: application/x-www-form-urlencoded

Signatures

Family: AnimateClipper,ZigClipper
AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.
clipper stealer animateclipper

Detects AnimateClipper 8 IoCs

resource	yara_rule
behavioral1/memory/5084-5-0x00007FF613FA0000-0x00007FF613FE0000-memory.dmp	family_animateclipper
behavioral1/memory/5084-9-0x00007FF613FA0000-0x00007FF613FE0000-memory.dmp	family_animateclipper
behavioral1/memory/5084-8-0x00007FF613FA0000-0x00007FF613FE0000-memory.dmp	family_animateclipper
behavioral1/memory/5084-7-0x00007FF613FA0000-0x00007FF613FE0000-memory.dmp	family_animateclipper
behavioral1/memory/5084-4-0x00007FF613FA0000-0x00007FF613FE0000-memory.dmp	family_animateclipper
behavioral1/memory/5084-3-0x00007FF613FA0000-0x00007FF613FE0000-memory.dmp	family_animateclipper
behavioral1/memory/5084-6-0x00007FF613FA0000-0x00007FF613FE0000-memory.dmp	family_animateclipper
behavioral1/memory/5084-10-0x00007FF613FA0000-0x00007FF613FE0000-memory.dmp	family_animateclipper

Downloads MZ/PE file 1 IoCs

flow	pid	Process
319	2620	chrome.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fdfd0b06cb31d68146dbb5ffb45b82ca1b59a7b4f62f917a990a9c3bd01654ab.exe	fdfd0b06cb31d68146dbb5ffb45b82ca1b59a7b4f62f917a990a9c3bd01654ab.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fdfd0b06cb31d68146dbb5ffb45b82ca1b59a7b4f62f917a990a9c3bd01654ab.exe	fdfd0b06cb31d68146dbb5ffb45b82ca1b59a7b4f62f917a990a9c3bd01654ab.exe

Executes dropped EXE 2 IoCs

pid	Process
1804	RobloxPlayerInstaller.exe
4556	RobloxPlayerBeta.exe

Loads dropped DLL 1 IoCs

pid	Process
4556	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4556	RobloxPlayerBeta.exe
4556	RobloxPlayerBeta.exe
4556	RobloxPlayerBeta.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4224 set thread context of 5084	4224	fdfd0b06cb31d68146dbb5ffb45b82ca1b59a7b4f62f917a990a9c3bd01654ab.exe	86

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\InGameMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\transformNinetyDegrees.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\DeviceEmulator\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Input\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Chat\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\DefaultController\ButtonL1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\ErrorPrompt\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\PurchasePrompt\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\icons\ic-more-friends.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\icons\ic-clear-solid.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\families\PressStart2P.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\MenuBar\icon_maximize.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\StudioSharedUI\pending_withbg.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\DesignSystem\Thumbstick2Directional.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\icons\ic-games.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\icons\ic-chat-large.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Vehicle\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\models\Licenses\Licenses.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ArrowFarCursor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\IndieFlower-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\shadowblurmask.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\InGameMenu\TouchControls\touch_action_move_1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\icons\GameDetails\social\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\common\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\DefaultController\ButtonStart.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\PlayStationController\ButtonR1.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\graphic\Auth\DatePickerDivider.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\icon_following-16.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Chat\VRChatBackground.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\Misc\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\9-slice\chat-bubble2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\DarkThemeLoadingCircle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\avatar\meshes\leftarm.mesh	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\sounds\action_falling.ogg	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\GuiImagePlaceholder.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\SpeakerDark\Unmuted20.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\graphic\Auth\FPSBackground.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\9-slice\chat-bubble-self-tip.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\avatar\scripts\humanoidHealthRegenScript.rbxmx	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\AvatarEditorImages\Sliders\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\PathEditor\Control_Point_Hover.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChatV2\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\Nunito-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\SourceSansPro-Light.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\XboxController\ButtonLS.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\MenuBarIcons\ReportAbuseTab.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\SpeakerDark\Unmuted40.png	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5000	chrome.exe
2620	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302870933290015"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-145f189a6a974303"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-ff6341faef444107"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-145f189a6a974303"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2384	chrome.exe
2384	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
1804	RobloxPlayerInstaller.exe
1804	RobloxPlayerInstaller.exe
4556	RobloxPlayerBeta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe
Token: SeShutdownPrivilege	2384	chrome.exe
Token: SeCreatePagefilePrivilege	2384	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
2384	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe
772	chrome.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 5084	4224	fdfd0b06cb31d68146dbb5ffb45b82ca1b59a7b4f62f917a990a9c3bd01654ab.exe	86
PID 4224 wrote to memory of 5084	4224	fdfd0b06cb31d68146dbb5ffb45b82ca1b59a7b4f62f917a990a9c3bd01654ab.exe	86
PID 4224 wrote to memory of 5084	4224	fdfd0b06cb31d68146dbb5ffb45b82ca1b59a7b4f62f917a990a9c3bd01654ab.exe	86
PID 2384 wrote to memory of 4112	2384	chrome.exe	92
PID 2384 wrote to memory of 5000	2384	chrome.exe	93
PID 2384 wrote to memory of 1276	2384	chrome.exe	94
PID 2384 wrote to memory of 1276	2384	chrome.exe	94
PID 2384 wrote to memory of 860	2384	chrome.exe	95
PID 2384 wrote to memory of 860	2384	chrome.exe	95
PID 2384 wrote to memory of 2576	2384	chrome.exe	96
PID 2384 wrote to memory of 2056	2384	chrome.exe	97
PID 2384 wrote to memory of 2576	2384	chrome.exe	96
PID 2384 wrote to memory of 2056	2384	chrome.exe	97
PID 2384 wrote to memory of 2828	2384	chrome.exe	98
PID 2384 wrote to memory of 2828	2384	chrome.exe	98
PID 2384 wrote to memory of 4136	2384	chrome.exe	100
PID 2384 wrote to memory of 4136	2384	chrome.exe	100
PID 2384 wrote to memory of 4684	2384	chrome.exe	102
PID 2384 wrote to memory of 4684	2384	chrome.exe	102
PID 2384 wrote to memory of 4692	2384	chrome.exe	103
PID 2384 wrote to memory of 2564	2384	chrome.exe	105
PID 2384 wrote to memory of 4108	2384	chrome.exe	106
PID 2384 wrote to memory of 3836	2384	chrome.exe	107
PID 2384 wrote to memory of 1048	2384	chrome.exe	108
PID 2384 wrote to memory of 1048	2384	chrome.exe	108
PID 2384 wrote to memory of 4152	2384	chrome.exe	109
PID 2384 wrote to memory of 4152	2384	chrome.exe	109
PID 2384 wrote to memory of 4052	2384	chrome.exe	110
PID 2384 wrote to memory of 4052	2384	chrome.exe	110
PID 772 wrote to memory of 3392	772	chrome.exe	112
PID 772 wrote to memory of 3764	772	chrome.exe	113
PID 772 wrote to memory of 2620	772	chrome.exe	114
PID 772 wrote to memory of 3764	772	chrome.exe	113
PID 772 wrote to memory of 1524	772	chrome.exe	116
PID 772 wrote to memory of 1524	772	chrome.exe	116
PID 772 wrote to memory of 4692	772	chrome.exe	117
PID 772 wrote to memory of 3516	772	chrome.exe	118
PID 772 wrote to memory of 4692	772	chrome.exe	117
PID 772 wrote to memory of 3516	772	chrome.exe	118
PID 772 wrote to memory of 364	772	chrome.exe	119
PID 772 wrote to memory of 364	772	chrome.exe	119
PID 772 wrote to memory of 4336	772	chrome.exe	120
PID 772 wrote to memory of 4928	772	chrome.exe	121
PID 772 wrote to memory of 4928	772	chrome.exe	121
PID 772 wrote to memory of 4808	772	chrome.exe	122
PID 772 wrote to memory of 4808	772	chrome.exe	122
PID 772 wrote to memory of 3972	772	chrome.exe	129
PID 772 wrote to memory of 3972	772	chrome.exe	129
PID 772 wrote to memory of 2844	772	chrome.exe	130
PID 772 wrote to memory of 2844	772	chrome.exe	130
PID 772 wrote to memory of 3620	772	chrome.exe	131
PID 772 wrote to memory of 2912	772	chrome.exe	132
PID 772 wrote to memory of 4152	772	chrome.exe	133
PID 772 wrote to memory of 1824	772	chrome.exe	134
PID 772 wrote to memory of 1824	772	chrome.exe	134
PID 772 wrote to memory of 4256	772	chrome.exe	135
PID 772 wrote to memory of 4256	772	chrome.exe	135
PID 772 wrote to memory of 2396	772	chrome.exe	136
PID 772 wrote to memory of 2396	772	chrome.exe	136
PID 772 wrote to memory of 1964	772	chrome.exe	137
PID 772 wrote to memory of 1804	772	chrome.exe	138
PID 1804 wrote to memory of 4556	1804	RobloxPlayerInstaller.exe	141

C:\Users\Admin\AppData\Local\Temp\fdfd0b06cb31d68146dbb5ffb45b82ca1b59a7b4f62f917a990a9c3bd01654ab.exe
"C:\Users\Admin\AppData\Local\Temp\fdfd0b06cb31d68146dbb5ffb45b82ca1b59a7b4f62f917a990a9c3bd01654ab.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  PID:5084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbb008c728,0x7ffbb008c734,0x7ffbb008c740
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2092,i,4453639399460836227,1396693372517351900,524288 --field-trial-handle=1952,i,10742418445477213770,10495097900199621660,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1728,i,2565461816593775794,4204446719614655500,262144 --field-trial-handle=1952,i,10742418445477213770,10495097900199621660,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:1276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,16722988240065996434,12844295808018728148,524288 --field-trial-handle=1952,i,10742418445477213770,10495097900199621660,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,13667921636039653266,11095442390333038405,2097152 --field-trial-handle=1952,i,10742418445477213770,10495097900199621660,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,7519781564110285583,16686827539916040414,2097152 --field-trial-handle=1952,i,10742418445477213770,10495097900199621660,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4340,i,16558572032243957392,5833448219565502317,2097152 --field-trial-handle=1952,i,10742418445477213770,10495097900199621660,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4356 /prefetch:2
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4764,i,6425024830620078167,5220420106158417150,2097152 --field-trial-handle=1952,i,10742418445477213770,10495097900199621660,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5460,i,3627535234731267207,1047109611737870462,2097152 --field-trial-handle=1952,i,10742418445477213770,10495097900199621660,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5968,i,1220662191241568787,7847876103055793383,524288 --field-trial-handle=1952,i,10742418445477213770,10495097900199621660,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,1846061560313057386,3022843217665233403,524288 --field-trial-handle=1952,i,10742418445477213770,10495097900199621660,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,4349273743605292250,9905197703599834607,524288 --field-trial-handle=1952,i,10742418445477213770,10495097900199621660,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5972,i,15548101718086248866,14073987415555476860,524288 --field-trial-handle=1952,i,10742418445477213770,10495097900199621660,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4368,i,18296796347124678686,17484327856832980362,2097152 --field-trial-handle=1952,i,10742418445477213770,10495097900199621660,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5348,i,1892450543212943413,14184441691409350929,2097152 --field-trial-handle=1952,i,10742418445477213770,10495097900199621660,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5032,i,7032287330507089840,18390788362004087394,2097152 --field-trial-handle=1952,i,10742418445477213770,10495097900199621660,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:4052

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbb008c728,0x7ffbb008c734,0x7ffbb008c740
  2⤵
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,3923698213623254908,17655553148095347586,262144 --field-trial-handle=1912,i,4942010604426434567,2225226791668979334,262144 --variations-seed-version=20260803-090054.390000-production --mojo-platform-channel-handle=1760 /prefetch:2
  2⤵
  PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2012,i,14854079748851555077,6386101946635397638,524288 --field-trial-handle=1912,i,4942010604426434567,2225226791668979334,262144 --variations-seed-version=20260803-090054.390000-production --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,5926989712004818183,10840936784360227198,524288 --field-trial-handle=1912,i,4942010604426434567,2225226791668979334,262144 --variations-seed-version=20260803-090054.390000-production --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,14351864457162723953,15313508601806715211,2097152 --field-trial-handle=1912,i,4942010604426434567,2225226791668979334,262144 --variations-seed-version=20260803-090054.390000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,7976855017996802162,8611993679409644145,2097152 --field-trial-handle=1912,i,4942010604426434567,2225226791668979334,262144 --variations-seed-version=20260803-090054.390000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4548,i,6525147301815714502,13722136889601929547,2097152 --field-trial-handle=1912,i,4942010604426434567,2225226791668979334,262144 --variations-seed-version=20260803-090054.390000-production --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,11167432667355394984,1939024006739414080,524288 --field-trial-handle=1912,i,4942010604426434567,2225226791668979334,262144 --variations-seed-version=20260803-090054.390000-production --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5600,i,4089640724154216391,783436553384505216,2097152 --field-trial-handle=1912,i,4942010604426434567,2225226791668979334,262144 --variations-seed-version=20260803-090054.390000-production --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4660,i,18303109712596466819,12455319395434348823,2097152 --field-trial-handle=1912,i,4942010604426434567,2225226791668979334,262144 --variations-seed-version=20260803-090054.390000-production --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3188,i,2245516608589925374,14392512376782745276,2097152 --field-trial-handle=1912,i,4942010604426434567,2225226791668979334,262144 --variations-seed-version=20260803-090054.390000-production --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5984,i,13631502348940929459,2174579011112122321,2097152 --field-trial-handle=1912,i,4942010604426434567,2225226791668979334,262144 --variations-seed-version=20260803-090054.390000-production --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,9195072223995438375,13547996786468585216,524288 --field-trial-handle=1912,i,4942010604426434567,2225226791668979334,262144 --variations-seed-version=20260803-090054.390000-production --mojo-platform-channel-handle=3460 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4640,i,1866276432790892560,10489823306358896966,524288 --field-trial-handle=1912,i,4942010604426434567,2225226791668979334,262144 --variations-seed-version=20260803-090054.390000-production --mojo-platform-channel-handle=3408 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4452,i,9132455226866553190,12332193433776155747,524288 --field-trial-handle=1912,i,4942010604426434567,2225226791668979334,262144 --variations-seed-version=20260803-090054.390000-production --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4556,i,12813345764360158464,12559426174500397358,2097152 --field-trial-handle=1912,i,4942010604426434567,2225226791668979334,262144 --variations-seed-version=20260803-090054.390000-production --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4672,i,15537748539816389523,14723027554203673268,2097152 --field-trial-handle=1912,i,4942010604426434567,2225226791668979334,262144 --variations-seed-version=20260803-090054.390000-production --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5848,i,13640780866253925972,13072113002994545798,2097152 --field-trial-handle=1912,i,4942010604426434567,2225226791668979334,262144 --variations-seed-version=20260803-090054.390000-production --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6240,i,13494426726347140251,351213681524514760,524288 --field-trial-handle=1912,i,4942010604426434567,2225226791668979334,262144 --variations-seed-version=20260803-090054.390000-production --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:1964
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 1804
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:4556

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.7MB
SHA256 a33eeac3fde1d1f99de2df08d63faa818ffdfcf2ace6a37e11bec1fe59409c5f
MD5 ad0dfa05fcbf007b1e2e535139317ae1
SHA1 8bff45114123dad46374913eac070a7255ca57df
SHA512 98e470bec6520eff7ff701d3448dff3682c39a1a9f95211595cb6fd5fde63ba26aeb79ccd32fe7adc1ab3e27d551474e41d4e56c1e2d8f01d4cfe9715c7c234b
SSDEEP 196608:ivgkZi/+KxW/hvjyysmsxP66IM5e5QIfqZzcz9P:iv3KpysmsxC6d5e5QI8G
TLSH
T17FA6AF22B900C032E8D100B296BD5FFA997D9E340B7954D3A7D41DB95A705D33B3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 934e8a2dd0b8fc2347eea4a5fcd1e0271ad9d5a2afa5dffa8aef017283231eb4
MD5 f0d9cdb92f2136d897525d63ed1a375f
SHA1 ef4e84f76ab149db1d7def9088d5e039eac018fe
SHA512 df19c50bb58e85cdd1b10d5ef14c6e5b0a2d4cb19e1a0fa5c4162ed9647256cdf4b62690daf9898df15c607728b24f1f1b75426cd85f7748ba211368898599ce
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3af93110ac422c2738a8a084e3fb16007c50dcb7c18d862b8db27e11a9dcd6c0
MD5 648e99e15a1b0921b8d45a038928ddef
SHA1 60b7174e4ffb9c7ce482c1c1ee87827315f6a5be
SHA512 dd25cc5bf883f5124122ca45ee69ab26a3897d9623e09967f335a2b85c5bc4a12bfe04fd9cfabd4e320d82797b8eac3b5e596615a36a0a07b3f403a8c6c41d0a
TLSH
T137E022B9C920AD2B08FD0729245C064AE754231B2B40856F7A3CD209CFBA63A0986C2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 8c06081ed702f6db5ac80c5d97ecf678995f9b3f463855b5669a44572c83c236
MD5 685c9141dd1e75ec9806d958265f8cc4
SHA1 c0289e38c3582a725e595dad5b39fb9cedd2a90f
SHA512 994b04fab40c1043b38818d4d924c88c0fe90d5c5de7685308cf0700aa6b2ea4e40a10ab193b8c87031f90099f94c866ec77565d903eba759c5c1c22451f444f
SSDEEP 96:mXnjWwPRxljGbvkUZBrU9QqJzyBjPV/W8AG75MVq:m3hHlvWqGjPV/WZ4l
TLSH
T1D6A1FA02A2E1F973CFA575B806E85C16653C10B4450A1F8FE4E9F939F54F2EE51831E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 648B
SHA256 1d22a9b90ef93b59d34d82e42e903e02493f700bc1917fbdcfe9a97ae40d1331
MD5 f6160ac4b64da77dc84f969bd69ead80
SHA1 b70406131a3dc0144fd20c66e1ca9350d733cad0
SHA512 5e3cbebc0cf52c78fb779cd84066573594b6815bf0485b1d212230d3a1b4aa20cfe29ae5ff05b1e0e9ea82d6d1b12f3fdbbbbf75bf52518cdf094661c9232424
TLSH
T14FF0274492518833CFFC16705CB47C27451169D601591ADB38E54F5EB81F5F9A5E8770
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 eb304622f92348ebfa52ba7df0566af7c69f4448c8f909497b8235bda2c40fe0
MD5 1bc07d11891fdfa2d7414ad0d85c72dc
SHA1 9e5f00eb555d0d4d3d3b941ed1f7a82041ed6ae0
SHA512 63348e9f31078b74f3e19015a0ad0742beabf562544b1ec281171d2ce703c4db47511ba4325719e3e30400033b5a97b6f59d7e535aa01a159ccab072da0186cd
SSDEEP 3:MsEllllkEthXllkl2zEklZj0T+l:/M/xT02zndq+l
TLSH
T18E4404047FD00505C50010305015C3500370D510151157533C53CC17DCC57411C04140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 8789e331ea48dc2f4aab9b8801df11981366e3faafd3b9f4aa665990e51abdf2
MD5 e4e3ccd7912dec965f86faf339818c2a
SHA1 2522a7bbc1a73fd69aea73d6d771c69e8fcf7dfa
SHA512 d7376f5cee9dc04f093bcf477a5a4d5ca327d2b1b1ebfd7ed45e2fcdae0eea3527c8b4f8aac7d1866b6529ce5d3a7cc2cccad70e88a36767bc24274bad031962
TLSH
T14FE0CD4474DDC1EDA575E867D765534C8BD0340CFECD7852172DE44C3186514A3E4B64
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons
Size 28KB
SHA256 fdb1fe3cbd42e66edca756ab0a10319fee6f19f341e1ab9773f987bca836f214
MD5 45dbda40be01394ae1127d2705bebf8e
SHA1 a9cda0a538b4ca32a4a259912e35757b2e000c2d
SHA512 95a7cc7e4d7b9e850f04d72d2e8af62049b8bf22b3629712bb93675ead08c29c031d0fe11f265b2ed4c0d2183ce842f14a60485efc5520bce9d240c9a693ca43
SSDEEP 192:ZcJXDEZFEZjKEZqEZnQRAtMUAlOPA1vvDr5n1UBv:m4OJNCLUu8KXX5n+p
TLSH
T17FD239CB6E343C73EFA9467E31366A74DE73D10D8F5E9CAB382054264CBC2455029B68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 66a8ce0723244ffed89e9327d6314d2939d1aa2ee99770e21c9b98a53e304d84
MD5 35fedc03588607c4aa2d4a8a5b81aef7
SHA1 299730d5769726d0662db8cad59cc0f73a25205f
SHA512 378c387678711d6ada52b18461174118e2ebb1f13775d55c7d4da740e1ef12a5757fcd5d1e7963b8a814d1bb4a5ac86fe076c8ca2cddb9af60ebe798fb3b3d4f
SSDEEP 384:OQvS/tIkUI3ijVYWNkqpf+FReMXy2Itny:OQvQ64idkq1qReMXy2Itny
TLSH
T180F341AF5E343202CEEDC23E68F645A34D6DE02FCB1365C66C211476CEE5656701C6BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Size 18KB
SHA256 f708c6ae2ea183e2a9f826016d993a605b8b96fff50edebe942fd0b88a90fd87
MD5 fdf8e7f322993e533eae16799268cf55
SHA1 1d6b5192d65bcb2621516dc3da025ac093b3c93d
SHA512 2899c1668a957472fd0ac3ab3aa37c087b7e7523dda657dcca98388d67a85975fae84f4217b0cf56f3529a047d39d8738c3a9f8c4e9ed6f01f5c72d4ece73b7b
SSDEEP 384:FWYbOVDkrwaZsDw4qvELP3iipMKCiGpyv6LnqaJwN7BT4bs:FpOVATSDPYEDSBKZ+yCdaN714bs
TLSH
T1788261283EFA501DB2B3AF659FE4769ADDAEB6333B0A945D0051070F0613D41DE9163E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 332B
SHA256 d03c59a7b64617b953eabc90105a1f3b77eb71b5f81156dc8f31db8e86f85298
MD5 67e7b07ecb9022bd087f8af04ba87ab6
SHA1 1facd985771df4b6f727011a4bb396c7efa1318f
SHA512 64a81d1605b8e8887dbdec78d992d2b27047406d62af96b4ac6941309d5cc79038ae835fc31d6b786a823e1245963eba9074478d031b67a241e4434e900ff8d7
TLSH
T19DE02690248DC2AE161C902BA234774CDBF03408EECE6E864F14F84CB6C6808ABC0FE5
MD5 SHA1 SHA512 TLSH

Submit Download

5307dbda-f47e-4fef-b0b2-e4cf1e15eb58.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5307dbda-f47e-4fef-b0b2-e4cf1e15eb58.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 9ff42ce2bff5e75edf7817ccf598d65eb52db58bd32dad30fdbfe8a57fbb1fe5
MD5 21deecaf06e1ab0ac7b35919233b804a
SHA1 d29c26a96d7f504281902c09b8f9e4f165037f79
SHA512 f207da63842c26adb9605dff159a7d4e08ac0ef5d5729e6e02a7c2d327a80104142f87970abfc08fb04cbb332ef1b72d0e85127ca1bafa74b87150e7df0171e2
SSDEEP 48:TL9aw/aHLopFMavU1iecDdZueFyEN7Ljo9AEfHEJUY/fWHHYp1g:HPareMatuJ2b9flp
TLSH
T1AA92FDAF1F301016C8BC973AD4C6485B5FFC110CA71777C65A50E672CD59CD7A7091A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 6d72fc927dfa9ad0c3368e97cb4a33b8ac3eaf177f6d1fc49e8485fc5f0ceb33
MD5 bb82aa9d1c7db546243168c5e491bd85
SHA1 68c59c7bdc6b33a6bff1718d87c54459a576840b
SHA512 d337c9bcb61a42762d46d13e84a8b3f93a302c53a7c4592c04fbaced8adf9c9b684b18239bf41ed817a0b04cd8360e1a44d8ba271286953260b6ea0dd4e0564e
SSDEEP 48:YALlhNhbhMhhSLS0aXYfoKsdUgmzsdNtsd9GJzsdAcsdDBsdd+sd1FsmsjxJzs2D:DjVaHufaIh8GGBxw9psjPhxWpF8g2
TLSH
T145B19BF3C3E8866DC91196F8DB156E1FCE2D0A24532C3C67C8D4AE5B93E2872D25464E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 4f9849cce54dd81d273916cefcdfca844d701351b3fa1243c23030453d4b9922
MD5 61a3634a2947a059b428366dba00a530
SHA1 c523b94cbeea1bb9aebcb46ff3f30d081eac9ad9
SHA512 ec386b4edcf4860ab2f29340fc801765965172bb51e66e8cacc2b6cd481b0fc4ae82d21d39004131a55ebddf3b8813040c108b1370026b02c615ef88f4d565f7
SSDEEP 192:DgoNyhgjbbQIM+vDQJkRaIhNsjPhs0afATugJQrMZ1V98yLYaP3vehfPrNPHI0u3:DgoNyhgjbbtFvDQJkRaIhNsjPhs0afAx
TLSH
T1C532AAF7C3E8C62D891592F49B15AE1BCE1D0A24432C3C7688E4BE5B93E24B1E21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 2bd7bdfb253869f7b1f7551b5416f981295ce0c41593175cb35b32e9f3dd1f6e
MD5 10248edfec2cc01372053cad92859c49
SHA1 55432923b38dcadc7cb672590747cf4b0dd666e8
SHA512 2bc3a6201bfdc902690f3e029311c5e02db6a3922e56266cd921c8047bddf6c9f24cea468c5cb7a117647a5dc435931780d9b81d43cdeeeee0912cf4bd0e5fbf
SSDEEP 96:eIEumQv8m1ccnvS600U1U9QN5QX1UqqQ2sj1pmPK7:eIEumQv8m1ccnvS60rUSQFUqd5yK7
TLSH
T11CF231FF1319B208C4E44574D2808A8FFE1B002C5BF9AAE5D6984DF3E2C75E3A12C619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 07c08087b4c8eeb8926e55009fbe654ac4ea9a773b00fae1d98d167c4d3d90a0
MD5 61420f785d5aa2613eab4fdf2be60a4f
SHA1 8d0275fe23b926b579efed09c97d9febca8c64da
SHA512 fa270bab73fda99f3f45ca6a80e338c6aafde08c8378bd6cea629fb1fbeb8577b60be02d1fa45b5eb29c5cfd84a79d991c8c9fa537d29702cfade62dba93c4c6
TLSH
T1C51192979EBDB497206D457B1D007C0D99FEA53041616DF4DEA6825CE0856F70B12212
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 57b232b45e7d0dda1c177ce529be6c102f921d1ee49544976bec982bf10f27eb
MD5 251d9a69e7c68372d3d61ed940ff9a10
SHA1 14a86c5a976fb01fed27b1ee76344d3175f1f39d
SHA512 0997bf2b9ab9ff4e0440e44e9816a20f922ba4f6f784c116e95a3d864e4d6bfb07eed21b5ede6881c62eb5bc3d29a4f4ef00f446f9247f1202485618c7b1b960
SSDEEP 192:ARIcBzE7nymzZv72ymwAPRp2Mal8A95Hsb+WN2rOrsI+o1jjxv2deeSl1raN6PVK:ARImzELF5QBXC7wiGl2ka+e
TLSH
T1DB62C62EA924397B6CE6C219F9167727E3F5206624D41E80FBFC9A2C05E75CC321702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6574c8b8db6daa08573875dcbf8aa17835b2b4f345ee589a65397dcb3e5f0130
MD5 c92bf0467a6f2468681659664cc72e77
SHA1 de24766c678268117e40f2a7aefa5d35edf9ec10
SHA512 ec2b09549cb3aa3eb0b9b0d8499614f48092603718906fd2f49a0a29268994af8fe95fa317c64525b0c56d9f81f4c29b3ef7f06e588ffa4f0bbc39f1f893ce41
SSDEEP 192:XRgE7nymeHv72ympAPRp2/95Hsb+WNnsShz6eeSl1raN6YVyIsnAUge:XRgEL0PQUXo7wthznaXe
TLSH
T14A42C62EAA14393B6CDBD219F9267763E7F5106635D41E80EAFC8A2C15E75CC321702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b18fd5934f270c66a631d034e450c8a6960b0f72bd1e4d551adb0e93391595f6
MD5 36b181c43afffaba44b41a428f7a3ae8
SHA1 030acc399e58e064679becca0ccd9964f815962a
SHA512 99bf648253f495f411a2c30eba258c234add668b288d44921b7a0725373740e5dc2e70408ae5730145db67379ea633ff12b55fa5f23d94b90028e126eb6f1f42
SSDEEP 192:XRgE7nym4Hv72ympAPRp2/95Hsb+WNnMq0vOeeSl1raN6YVyIsnAUge:XRgELuPQUXo7w90vTaXe
TLSH
T13C42C62EAA14393B6CDBC219F9267763E7F5107635941E80EAFC9A2C15E75CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5101827638662ee99906903c7c86fdb0fe1f163e78261efb0904c1f92f8e9b08
MD5 ab8885f4f7f5e39f40bd5c673d35b753
SHA1 d4e66d1676be263eda75e682fe329bea2eb605d7
SHA512 fa67ef30337c5b7ff46e1dc86616af0ca9242f147cb6d0310475bd33156e36b2e73e30d34cf4f610f76bf4946e0b7f1e6456d4756c3d9e58161bdd1afcce1270
SSDEEP 192:XRIcBzE7nymeHv72ympAPRp2Mvlr95Hsb+WNYssS/ag2GeeSl1raN6MVyIsnAUge:XRImzEL0PQUXL7wHh2Laze
TLSH
T14152C82EA924397B6CE7D219F9267723E7F5106625D41E80EBFC8A2C15E75CC321702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 bee3a2676a55df6a3c8d0cb3e0f6e5433d8da0fd1e44b8555f4675a2a270300e
MD5 222a6d5f1b5ed2e6e2e40f94f14ae3a9
SHA1 6c2cdf715111253d37c288ffd67cda24fd419114
SHA512 5f6961cb7e5551ab0891b712a2d957084c8cb117006ef1326ac555d8dacbc3a02bf2887d61aa50b377781335b81b309f5a04e769e91c53afb8cc0bbbe5761ae6
SSDEEP 192:ARIcBzU7nymzZv72ymwAPRp2Mal8n95Hsb+WN2rOW6I+o1jjxv2deeSl1raN6PVK:ARImzULF5QBXJ7wPGl2ka+e
TLSH
T11162C72EA964397B6CE6C219F9167727E7F5106624C41E80FAFC9A2C05E75CC321702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 14e0192039ab66ebd5a7572ec7c87cdfacf21877053735ecf9e9465bde9ce83a
MD5 c5987aa1743842f6296ba13a96a89fb4
SHA1 c064296c3e1ee7321bce5cc353a09bda74041187
SHA512 580ba09e9f0e374f229fa06b89da6a2ea6af7773cf1a28e9b8e0e953f72f3ead4fbba7e796b29595cc1b46e7e6c796dc3a067fa277b8306e67706ff3f3b29244
SSDEEP 192:LRIcBzE7nymeHv72ympAPRp2Mvlr95Hsb+WN2rOrstT/xag2meeSl1raN6mPyIsB:LRImzEL0PQUXL7wCj2raHe
TLSH
T13D52C82EA924397B6CEAD219F9167733E7F5206225D41E80FAFC9A2C15E75CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 79673a6df21da1a2a43618f93291457121ea5bd67a87a0ac1b1eb1bd8295c375
MD5 3901309a9c49c4b01d0a24262b2bdc5a
SHA1 181c337cdccde5a217082cf3466fc1d89a34609e
SHA512 699d4544494dbb0d99d94c76ea6a51b07edf741f4a7c10e0dd6d308942c7dd30197c00b9e347a7981c04ae3e2f0067751225ae1e0cf650c792779e8414ec2574
SSDEEP 192:iRIcBzE7nymuZv72ympAPRp2Mvl2NY95Hsb+WN2rOrsigOagDxv2heeSl1raN6PM:iRImzEL45QUXl7wmMF2Qa+e
TLSH
T14662C72EA924397B6CE6C219F9167737E7F5206624D41E80FAFC9A2C15E75CC321702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 f94b49f1d3e97190906898fc9899e1244e76493ad0b2163086395113d0854268
MD5 22262540e8b086b58c64f2c0a839849a
SHA1 b09edc61bd1ca7bb75c0c4572b407e07e2d989ca
SHA512 3add6199b10cd907a93b49a164cd7f57018b17b330cbc7a4c36d13b37e3a8bddfb6dafa48e45ee5a7c6f6d0d51dd95c14424cf7e30d563d5d8b26d33dba3820e
SSDEEP 96:F1mKIMiRwcnDh1JZx6LXbXFXKXT1FXSXTaXFXKXTcxhXsXn0XbXNXKXT0uZXIGXA:F13ldmDhRwL1ajbCja1ajq8kL9ajj4GQ
TLSH
T13DA17D6EB909184EE4AD0936CD78571B6F69CF0C27FE3767A9DF8A0405B0A5701086F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 4b050e82cfe9e5ea836e3626bb6f5e0cb956b63079d66682aabde090a606ebf6
MD5 00abbcc68c1257e485d270539a090c29
SHA1 5cb4e5033d27e0095b1957c69f40d8f4c711bf7a
SHA512 428a04438374ff77268b0409a5899c32d1e37955a79b4633b5a602b9484ef1e22d45f17b646263d012bb80d6e47c971e6906d460db0a8705c73e12398399a145
TLSH
T118E02C0025CAE2FE207BC0070AB2930C86E4B40ADFCC38425F20EC8831C6A08B3E1670
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 9d8340db751b33e6ef5aa02790e2aae6a03270da8901e4c41543a5720a2c6c5c
MD5 aa2232d4ee57310446c0463ea0aabfd9
SHA1 939e6ddd615643dfa8dc3a911608a20ea2555003
SHA512 b3cbac6bf83c82d0abde16a1ccd641443a9a67322d06a092a4a7e5f731f26b47719614cc443b82e94f640c5ad50eef1ef750d825a69e228de9691da432c083c1
TLSH
T146B0125080015102C00202F812423888F1149F389A0B170143F06D228C295508158550
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5911aa.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5911aa.TMP
Size 96B
SHA256 5019a916d701c6eb598a8c157ba042f0310694b844fcbe4683e0515c04599a16
MD5 536adbeab95e83dd568fcc4cc93fd750
SHA1 3e139acc5e0fad1e173edeecc8fb5fd017657787
SHA512 e25803960fe70c13f4278cb961117526805b64397770bc8946bfc943a18d0a26be7eb5568f53765fa9e03b684c9be1c95c5d8360f0ae0176d15a941bb15ef3a5
TLSH
T151B00255C202B352C04283B06D9596D87165DF35D617162BA2E81A67DD2AA608525D60
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 1KB
SHA256 87e07fb3c80b9459ed173bae8bcb71102f33bbfce969717c128f2578f122bd93
MD5 0500d9842d34342430e67fb3ef7a5840
SHA1 2daa9518609657654bb0016ce89528c82f1470e4
SHA512 e2c8a76cda1466b461c2f34701debea6627c3ff03d9b79ff1f790738d60f475d53282e72040ff0cf07e3d8e5c34c5e8b183531e00ce55bf41c2eef34a819daea
TLSH
T19E31BED51DDC617BFEF958746CF713B10E31F6510E34489A86A4779C002B317782941E
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 320B
SHA256 d6508bc0aa15bc6326566be343569f0cca9fe2abf535fed78980e7853b12c589
MD5 1abf9c2027ef323ac4bd1c14ee4553c4
SHA1 468d0469d46a734d394485fcdd1229bce7d5bf85
SHA512 1e26d611a25d24774e4847d49322cef0f299c23b5e6fc69dcd9bf0f2c4e88601f37320156360ff2707cc98cf2829e502438777b6195e1524a3dd479dfeae69bd
TLSH
T13BE086542489C5AE16A890672670A34D96F57408FFDD6C561B15F44C378680477D0AA5
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13430287109704365

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13430287109704365
Size 5KB
SHA256 764dc12ede748171191464c9b604939a18e89e74ee8c95af09cf068bc8553592
MD5 75caf5b53e613f61ccd0ad6b60ec197e
SHA1 52dd90e47965a42e4dbf3c5c955b8cbef498df60
SHA512 632bfa76a3f0f4440eeeac6096be3d90fc3f260ad3a35a0a329fa42155c7a006ea7db67f4023622fe80cfcf5b2edc70827ac8a0de5fb8128df2c9579d9b8691d
SSDEEP 96:3dcqgN5LMHtzYZoTlueOCTlueOFwzYZpf2OJzYZFzYZhl4eqkR:3dcq2LatEZoTgBCTgBqEZp5EZFEZhlFH
TLSH
T109B15463E5F0403DF27FCA3CA9B922F16F76FA4158A18CAF512192050432A122F75F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 459bc34979b38ecc8743612322c28ab239457f141a4da2d5783bd347bd1243c4
MD5 5f7191f9503298cf58567eaeb9da8f02
SHA1 a9b9d04bda0b8d5ab6ba7938bc3d2a5139732713
SHA512 fe451d15771ec6ee166f3f860d545c2145e25f64a8ea5b0b12c72498a42ad64f1d7c3c8a56b3b4a8c5eaf10e2000cba4d518f8892e2c0c4e29f60df5cca170eb
TLSH
T1CCB0220C30C08822CE2C83B0A0C0C28BB8223C0020830383B0F2A88CCC8B0803200802
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\db
Size 44KB
SHA256 6a140ceeaf425963ab2b25c2a79cf89b544d6181cbb2125bcfe8996b0ac853af
MD5 f79dc1184b0e59adf099c4552bb0a259
SHA1 92132d04635c18f2fc9543f7859b877058f0ea65
SHA512 15b496d25d2066c3ab931bfde8fe636679c048ab0ebe17adb012c46d76a14e05c7ef2ff30c4b74e54b2018d602bae561df455cf16164bc582b9f7cc58e1eac34
SSDEEP 48:TVOIy4m1b3fbUt1q0BksX0PIOwOIv19TXSqE0it:0L2P5OqOH0it
TLSH
T1141311DF2914B582E2F8C531E09A9EAE5E3F314C9EC3A8C559B006B30CD086C491F5BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
Size 172B
SHA256 2a9dc01ec343c6298287e7d3c952c1ecdcade876d28566cbcec38acf6d740f26
MD5 0a680b8e94159cc0d56e20ece2bd7735
SHA1 9ca7ed5b25facdc81423b50108118d11df8cf279
SHA512 43390b709f9b0ebdc43584d8d4c51152d53abe3c09523e059bfd90319a095e94cec7895eb6c63e742ee21bba9a3a75eefabb8bf730b794bb93c81deb08a1eb61
TLSH
T11CC08C0473A16005E84C4634428697082B00FD3311514533ECE0D6205FAAE24BDA6AC2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 c6a43915d0351d80fdc523db07426d396eda8e8fd809c239246fadeaac083aa2
MD5 eb1cda597f33f8646415d7b1d251bd4d
SHA1 e757683ada4314f50520dec09ca8beb017effbdd
SHA512 b2fa45bc2d13a1e8e7d31c19e87fe7bfee1ac881634bae83c76d03c1a65345d50494555fe8469c46f0ebe405756de4a39b4cf30219a910a45bcd8519fdbf49b9
TLSH
T183E026603ACED7EF2196901B6270E30CC6E17409EFDD74622F24F488728A40473D2A60
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 2d4c3529f9cf766f6722b14cbb213fa6ada5b165c220ab6a8229e181eb0369e4
MD5 3ecbd1b66a5d53f50f31597e1bc85f95
SHA1 41d61bc77fc42382c67dc593f6e9defe3216e68b
SHA512 9f01e8e5343f0eaefc28396865be1440e82fb49efa2a3c72adaccf33ead0ce9cd5ca900ea4d553d4e0ce7c9dc03208037f9f79010b2abdec1b70514603bb70b9
TLSH
T1F7E026B065CEC6FD1461C04B5370A71C86F07808DFC935825728E48C72C200C63A1AA0
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 b36e9d646cded5067aa50af3a6e8aab4b526ff3dd7a08e0e3be9683680a7ef0f
MD5 ed2a4e2378e8f33aa085a7424f1ef8ae
SHA1 7fb8faa1c5dd0b2f68d67acc6b75cb8a86bfee0c
SHA512 a0ac2ffa21d29fdd8843c14684f59e6e0232e9b38531ecb75449998ab0a5a080606651038e9a820e13e643280427dc8ff9ed6e7367daacc7c44ae5be13d9f394
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2wj96mAdqEVumIw9Ym:jeuvBnhJsueMEGvIW1DcP24tAfVumImP
TLSH
T102D3864B3A743102EDE58E722CE0517B5E3CB17D8F55A5D4287620688EF2863A23D0BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
Size 40KB
SHA256 c389f1378fb754a446e82ff63e2928c828b2840122a7b4b677f1bb47f9aa3417
MD5 608dc26216c0f586eca70b14d129c7b6
SHA1 d5bde71c1191d73631443c2ac45c6034d6d8ceb0
SHA512 dba453c8dec9e25506a89c053578801fe3087daf5bc438554c4064323cbab48b7ce3acf1ffc0123035fe4ddcf400957b9abc13d9f3dfe10a9a5a94df22bf6f9e
SSDEEP 96:f7doKsKuKZKlZNmu46yjUKVXwX4X+XvXRy:7ZT0nzXggxfhy
TLSH
T12B034F8F562840F3D0B2C23EEDD649D6FC7C260CA7237DE519E907615EAC03B90182AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 8KB
SHA256 912bba4f1ae0991d1c96dc5aa4d14711471da436da8fed0c04b6233cbebbeadf
MD5 acae4b8843549a5d11c4a4f2a6460e9f
SHA1 8cd793a5e1ec3f1027b63a708c35de89d237bb9a
SHA512 c8bac7018247a111a66b54c5f01ee8e82baba8d5fca91ba9956de8cb3c8da984467e82e8cd64d2c7443044e737463ec6420a6d39505d073244d5b24a3964eec2
SSDEEP 6:w+qVkzA5w+Bcc/XKuqHKu42n+lQyCc/mLEJOgLEJLqn:w+qVk/+BXXwX4vnmLULIC
TLSH
T10D02DFCFA408448BD420123ECABD99C26D390D883B53BED95DE58B0828B960FC40838A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 27KB
SHA256 f160aab7321d5cd3424cda338a1f56e5afb1a396c4a753201580929c31e3494c
MD5 1361327e9fef8eb1b4c7850b5e783c45
SHA1 2964593d9ccb327ec5438f683f1ab468b77eb8a8
SHA512 9747c300214d841090622e705802fe09c563d19e9f07291da4c66b44179b96e81286f8bbf2ccad98d4973847dda46bcf53e1c7eca9bbddd9e8b770c7f534a7c2
SSDEEP 384:KjbXsdGsNLQXIIImbGMIMNBtaDCsdGPJ5/isdGGbaosdGPdGLqfYa0JCsdGPdGPW:/NLQnF3fyW
TLSH
T165C2B857D3B01B96DC8F97FFFC748CBE0BB69C8948560001A4D26BFB2863E26494175A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 d18a656aa7de9e4953db12b1a970d84c7af077446b3862c606c41bfbe295e212
MD5 198e978e0a996b5015dd7be8045a89e3
SHA1 89c73b559c33bfaa89767f28ed58c4fe86db76fe
SHA512 5c95dd9dcecf7b271ba7349853cc4cde1b394bd80e62a2043dba3bbd61a35de3a44380ad43309130a10ed5b95f554934eeb2eae21ee51e52d939b68f9cec8d83
TLSH
T13AE07200B8CAC2EF6439800B2232A30C87C13809FEEC38860F10E04CB0CA008B3C0B68
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 552c5fd8690c73cf7dddd6daf5bd8f8f7be7611a84b76f37c3eb50162900a283
MD5 3713f04567fdb200a0b3e459ce3d99e5
SHA1 0150490693f560c0ac66a4a6aa94db6499b2a744
SHA512 b6bf9b39525ecc49c2a0d919c9f9797fb03992a2c1dafcb000002b1fbc2da40cd1e0bae3fcb405db9c33789f0969dc57f233aba7cf88e193432c21b32f5b18d9
TLSH
T1F321F191F330C509C25A427B617E6B651338D4539FB8FD0F24BA20293EB6E550C8B2E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 335B
SHA256 bbfee22f96aeb923232b996dbae7c7bc7429ff4b6ea149d871afb6db1f16a4d8
MD5 40d9fd615dd5bcb3b5dc29bf32bf85d3
SHA1 b643c14f93dd9bd928abb78d6d8c09924ea9406b
SHA512 84cd6e6c6bc3d70f69202064c3273da7c64792676f844e5f87527eddf917cf6071b7dd3ce410e9292a0e49aca914a32b569678b1832309460a15cc069f475e40
TLSH
T19BE07D00B8CAC1EF403180171171B34C87D13C48FEEC3E420F10D84CA5CA004B3C5768
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 f6e66f52dc2607cac56e295683ed78078b0c4da0891739271f0909052907478c
MD5 6100096e696055e73ad39bbe372bb167
SHA1 5868402a9048aebd9d53ffb75f43b81f0aa6c950
SHA512 8cfc105caa16010449cb8f86115f5ff5d533454c7977424e60db9bc1a71153426f2a6fe3d3475afe715cb8dd19316bc87bb072eb1c10383aaee12a37b44d2953
SSDEEP 3:MsEllllkEthXllkl2zEkl+n/:/M/xT02zn+/
TLSH
T1FA440444FFC10C0DC51010304111C3F003F0D45005D3574734530417DCC57540C04500
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ac45e18c14d09542fd90d241bdbfcc142941440dc5c9ceb4cdee5b761a66bb2b
MD5 eabe75cecff041487ef994e0d5fda6ba
SHA1 36ce3a7bf93fe6803e01ea2aaf35798be23c6bea
SHA512 19d75b341b3004508e690269679a9e693bf567b0abf29787563bb82a827b07c45366c0737d91802bcc4617a8dec9ab75d4dcaeb22917bf23b92dfb624650375c
SSDEEP 1536:XMxNyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbu:uTqfd7NtZL8cHQRZEQ6SpsJ
TLSH
T117C30237ABC61E339ED2CB70B9230ED797B544A99034D305AB6D27EB6883895684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 5b1506ccb5a46bf40edf46c695e1c53390ee7b628fa64c93656ce5649ad83e08
MD5 34b498d15c59cd8efdb6578f26553995
SHA1 e4b0a38d046d6577438d0641a51486f9f2c1ab04
SHA512 7eb0ed77f556a018f4720a06b2d04d9ac5dc8ef9486aac66b7c9724f3ab8b7f3491eba932e39f791ae75fb12e9438da189a6ad9ddb7ce310ad3e6a1b4f939c97
SSDEEP 3072:j0b8B8LH2L08XbWURJjXbPN2VWqkMc6d2Wl:j0b8eLs08Rfw8Tez
TLSH
T13FC3126389B9BEB2D11DC516FA21734E4EF4ECC83051B2B8D8587B9312C8B9C1795F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 78c658e1435820fcde1eda964e38da0dc66933e47fe549d8344511a6f7f71526
MD5 f56e0b95a33386e72f2b213e2676185b
SHA1 2954ac4bdb56e19aaf74d17e6d2b0611cf78e419
SHA512 723fbce6f53c3b7b5e177d74e78ca30f51c7aacc9f6c9a59fcafb3b1a08e1b0487afc4d6080770339fa4a5b9226a2e4154384e6d775cfd3405823996f86a3251
SSDEEP 3072:W0b8B8LH2L08XbWURJjXbPN2VWqkMc6d2Wrqfd7NtZL8cHQRZEQ6Spsc:W0b8eLs08Rfw8TepqZ/ZLW3Exc
TLSH
T1613413738BD27F33D946CA64BA637BDE47F48CC86030D354E92C77E72982A54298199C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 41bcc62c9807704a4731909325f83797f2b4c0143c99dcdfd728d7fa0b6e0a3a
MD5 73d131d4532988adfb6cde0a0a956eb3
SHA1 aabd7581501331e435bd53f1d8a043e7a7ac1554
SHA512 0823061b96acc1877d459b161d483b3ff83c4f96721100e9e8d055f95a8cdf36c346f2efc60531761670a3cac094bab1a5a8bafcff7101fc9855476cdac05feb
SSDEEP 1536:TjQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:Cqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1F3C30237DBC21F339E96CB60B9530FD697B644A99034D301AA6D77BF6C83891684289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 2c2087f2493a145584de08cf5426d245ba3050cbcf2221d7f003a07b82650f03
MD5 8183ad4e07fc787eb5c2a7e4454638c7
SHA1 fb5ca9441e11cdea3aa992fd94d0c629d0fa7868
SHA512 7a3b7074be5c39e40a692ad8be2c1868c49fa8650ea137daa738c48ee92e070d36426d7b8093962b858be8df65dfb04c6c66e3302f02edb34d3a5ea4c825ae59
SSDEEP 1536:eMxNyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbu:jTqfd7NtZL8cHQRZEQ6SpsJ
TLSH
T165C30237ABC61E339ED2CB70B9230ED797B544A99034D305AB6D27EB6883895684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 0156d52e3adf34b372fd0e864586e7fadc3c33795df942c5d13cdca0f10016db
MD5 36e8733fe7ce9812d33049eddc7c44cf
SHA1 913f795f3753b72b886a38a3588e895de7fb488a
SHA512 8cfb2786e8e7ddf47d9f8ad787e6faec2661fab7efb8dbdf3804192a9fdea50eb60f55a71dba2c5bff9116f013f0a0067e832cab95db1f572ab14b698916766b
SSDEEP 3072:U0b8B8LH2L08XbWURJjXbPN2VWqkMc6d2Wl:U0b8eLs08Rfw8Tez
TLSH
T17DC3126389B9BEB2D11DC516FA21734E4EF4ECC83051B2B8D8587B9312C8B9C1795F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 b8e17e0a4b6b637710d2ef22ef88f8fe9033e1604730ad2bf9207d4d61250811
MD5 bd5169acc284315c5807231936233cdb
SHA1 ef95dbca566a144998bc3b3b0364c287f9c337d9
SHA512 eaded3a7059d11859eb8ad84f6c6b9bce53d130cf9dba0194d9833b4603c2796d0eeb8243385603db5a34584eaf11058e3c6f839e82cf40189fe1bca9bdf8c6c
SSDEEP 3072:Xpb8B8LH2L08XbWURJjXbPN2VWqkMc6d2Wl:Xpb8eLs08Rfw8Tez
TLSH
T180C312B38C75BDB2D159C81AF612730A0EF4EEC86551A6B8F81C7B4222CDA5C0B56E94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 200KB
SHA256 8f8a61c6be9a4bca36b564be15413ca19a90ebd06cd5b58f6899cd3f2fc6d888
MD5 d3ed52d223950884690ab4af568f8272
SHA1 bae7a69c035b84d4b223e9bb7541316e74d7c763
SHA512 b992cef1bde111f086899ecb474d1d21c171ccb5fdf29c90183c892f2fa43e08d6afe778a8ef294fff299315169cab5db848233a0c9296dbee1384052c1489da
SSDEEP 3072:qodmX9HjUFIxP6eD58vwj70Kmtc0xsk+qU9b8B8LH2L08XbWURJjXbPN2VWqkMc8:ZmXaFK75BjQFTLhU9b8eLs08Rfw8Tez
TLSH
T1171423B30C69BDA2C589C9BD5506334E4FF4DDC86260B5E8D41C7B9620CAA5C17C2EE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 3f6181c97d89423bdbbcb1163af3e029ed888fb7821bf1b0cbfbb8b1b54aaade
MD5 4a537967d17dc56922d19728e3e8933d
SHA1 fd04f2bda1141c318dd4f6749c7ca6015027c007
SHA512 877ccc52f902b31760e382ad20b27be3847bed2b0b3343cbd4314466d69cb7d6d00a4ce4b985270c9d23948e67cab29793712accf978da1d4df111d0f0801d64
SSDEEP 3:MsEllllkEthXllkl2zEkl:/M/xT02zn
TLSH
T13C4404047FC00437CD4010344011CF5003F0D4100D11FF4334510417DCD55410C01010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 023bf497fe02b386c2de3e2843e1f072b1beb5af0328b69c8fc03a7616923bee
MD5 6dc3a24d0f0a951520e188bfad3030e7
SHA1 b2efab55417ef594780b81b4a4285c26c43ffe99
SHA512 5460baa93d7e354d61a870cc5e1405b3086521c98f02cc2e1d9f0275cab922a718f708b42e56230228ca1283e0ee785bdd3e1fefc85c6740f99095cc155b1479
SSDEEP 24:T66Qcn/CVdn+xxnFn6ZOTs0n/YSRltqtD9ijuoxAYGduhr2fk05b53HxOSRtK0J3:TkkhCU2QB2zbBxxopkazYZXYzYZmvEOM
TLSH
T19023108F2B1821CDD1D55A3EFEE24DA17DBD0F58CA1B68D608D019724CE00AD912F2BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerInstaller.exe

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
Size 9.7MB
SHA256 6fe4e34d4140fd0dcf70dd5d489a56c3ca6b6de28fc19a6745a3d7eb030c6f90
MD5 b37da17b4c0f17be88c1a4d8ed38f779
SHA1 65f6b893ece9c5f0038ba2f3bfc08d8cd1133d38
SHA512 5659c01c11e750083d29b206ba1abc477e638920beef28f9180f7c8f148ff3c8f1d715b3e052e5afd43a776bbaaf99a69618a94a18aaf474150f3aa3ae6c8021
SSDEEP 196608:lm4L3+yKlLWA4MhfmsxfMgkjvJZ/L8Z4UrbW0:lzKhfmsx0gSvJZ/L5UfJ
TLSH
T130A6AE22F900C032E4D100B2AABD6FFA993D99341B7954D3A7D459BD59305D33B3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5084-4-0x00007FF613FA0000-0x00007FF613FE0000-memory.dmp

Download

memory/5084-3-0x00007FF613FA0000-0x00007FF613FE0000-memory.dmp

Download

memory/5084-6-0x00007FF613FA0000-0x00007FF613FE0000-memory.dmp

Download

memory/5084-7-0x00007FF613FA0000-0x00007FF613FE0000-memory.dmp

Download

memory/5084-8-0x00007FF613FA0000-0x00007FF613FE0000-memory.dmp

Download

memory/5084-10-0x00007FF613FA0000-0x00007FF613FE0000-memory.dmp

Download

memory/5084-9-0x00007FF613FA0000-0x00007FF613FE0000-memory.dmp

Download

memory/5084-1-0x0000023FB7ED0000-0x0000023FB7ED1000-memory.dmp

Download

memory/5084-5-0x00007FF613FA0000-0x00007FF613FE0000-memory.dmp

Download