hxxp://roblox[.]com

Analysis

user interaction
yes
max time kernel
896s
max time network
907s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://roblox.com
Sample260808-rt6ahaycpg

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
10	696	chrome.exe

Executes dropped EXE 10 IoCs

pid	Process
5308	RobloxPlayerInstaller-PRWHPR32JQ.exe
4960	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
4996	RobloxPlayerInstaller-PRWHPR32JQ.exe
2080	RobloxPlayerBeta.exe
4040	RobloxPlayerBeta.exe
5872	RobloxPlayerBeta.exe
4228	RobloxPlayerBeta.exe
5200	RobloxPlayerBeta.exe
2340	RobloxPlayerBeta.exe

Loads dropped DLL 4 IoCs

pid	Process
3876	RobloxPlayerBeta.exe
4040	RobloxPlayerBeta.exe
4228	RobloxPlayerBeta.exe
2340	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller-PRWHPR32JQ.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

pid	Process
3876	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
3876	RobloxPlayerBeta.exe
4040	RobloxPlayerBeta.exe
4040	RobloxPlayerBeta.exe
4040	RobloxPlayerBeta.exe
4228	RobloxPlayerBeta.exe
4228	RobloxPlayerBeta.exe
4228	RobloxPlayerBeta.exe
2340	RobloxPlayerBeta.exe
2340	RobloxPlayerBeta.exe
2340	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\configs\DateTimeLocaleConfigs\ja-jp.json	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\fonts\SourceSansPro-Bold.ttf	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\StudioSharedUI\MeatballMenu.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Chat\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Controls\dpadRight.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaApp\graphic\gr-avatar mask-90x90.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Moments\Reactions\laugh-joy-xsmall.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-online-12x12.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\FlatCursor.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\StudioSharedUI\dropShadow.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Camera\CameraToastIcon.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Emotes\Large\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Moments\Reactions\Animated\laugh-joy.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Settings\Help\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_17.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\fonts\BuilderExtended-Regular.otf	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Controls\PlayStationController\DPadRight.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Emotes\Editor\Large\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Settings\Players\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\StudioSharedUI\dot.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\fonts\families\PressStart2P.json	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\MenuBar\icon_leaderboard.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-instudio-8x8.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Settings\MenuBarIcons\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Vehicle\SpeedBarBKG.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\DevConsole\Arrow.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\scrollbar.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\VoiceChat\SpeakerDark\Unmuted40.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\VoiceChat\SpeakerDark\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\LegacyRbxGui\ComboBoxArrow.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\sky\cloudDetail3D-bc4.dds	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\avatar\scripts\humanoidAnimateR15Moods.rbxm	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\AvatarEditorImages\Sliders\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\ExtraContent\textures\ui\ImageSet\AE\img_set_2x_3.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\sounds\oof.ogg	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\chatBubble_bot_notifyGray_dotDotDot.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\account_over13.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\CloseButton_dn.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Lobby\Buttons\scroll_left.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Settings\Help\AButtonLight.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\VR\buttonBackground.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\avatar\unification\CollisionHead.rbxm	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\Controls\PlayStationController\PS5\[email protected]	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\InGameMenu\BackgroundGlow.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\InGameMenu\XboxController.png	RobloxPlayerInstaller-PRWHPR32JQ.exe
File created	C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\content\textures\ui\InspectMenu\ico_inspect.png	RobloxPlayerInstaller-PRWHPR32JQ.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
696	chrome.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller-PRWHPR32JQ.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX-PLAYER	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\PROTOCOLEXECUTE\ROBLOX	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller-PRWHPR32JQ.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306730312493441"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-d584fb6c717a43d9\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-d584fb6c717a43d9"	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-d584fb6c717a43d9"	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX\SHELL\OPEN\COMMAND	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-d584fb6c717a43d9\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-d584fb6c717a43d9\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-d584fb6c717a43d9\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-d584fb6c717a43d9"	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX-PLAYER\DEFAULTICON	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-d584fb6c717a43d9\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX\DEFAULTICON	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-d584fb6c717a43d9"	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-d584fb6c717a43d9\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-d584fb6c717a43d9\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ROBLOX-PLAYER\SHELL\OPEN\COMMAND	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-d584fb6c717a43d9\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{3CD674F0-A1FB-4A6E-B8D7-9D8E62953ED8}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-b2d03e4efaa04174"	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller-PRWHPR32JQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller-PRWHPR32JQ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller-PRWHPR32JQ.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
6116	chrome.exe
6116	chrome.exe
5308	RobloxPlayerInstaller-PRWHPR32JQ.exe
5308	RobloxPlayerInstaller-PRWHPR32JQ.exe
3876	RobloxPlayerBeta.exe
4996	RobloxPlayerInstaller-PRWHPR32JQ.exe
4996	RobloxPlayerInstaller-PRWHPR32JQ.exe
4040	RobloxPlayerBeta.exe
4228	RobloxPlayerBeta.exe
2340	RobloxPlayerBeta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe
Token: SeShutdownPrivilege	2680	chrome.exe
Token: SeCreatePagefilePrivilege	2680	chrome.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe
2680	chrome.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 3292	2680	chrome.exe	88
PID 2680 wrote to memory of 5316	2680	chrome.exe	90
PID 2680 wrote to memory of 5316	2680	chrome.exe	90
PID 2680 wrote to memory of 696	2680	chrome.exe	91
PID 2680 wrote to memory of 756	2680	chrome.exe	92
PID 2680 wrote to memory of 756	2680	chrome.exe	92
PID 2680 wrote to memory of 4920	2680	chrome.exe	94
PID 2680 wrote to memory of 4920	2680	chrome.exe	94
PID 2680 wrote to memory of 3384	2680	chrome.exe	95
PID 2680 wrote to memory of 3384	2680	chrome.exe	95
PID 2680 wrote to memory of 3836	2680	chrome.exe	96
PID 2680 wrote to memory of 3836	2680	chrome.exe	96
PID 2680 wrote to memory of 5848	2680	chrome.exe	97
PID 2680 wrote to memory of 5320	2680	chrome.exe	99
PID 2680 wrote to memory of 5320	2680	chrome.exe	99
PID 2680 wrote to memory of 5328	2680	chrome.exe	100
PID 2680 wrote to memory of 5328	2680	chrome.exe	100
PID 2680 wrote to memory of 2652	2680	chrome.exe	103
PID 2680 wrote to memory of 2652	2680	chrome.exe	103
PID 2680 wrote to memory of 5988	2680	chrome.exe	104
PID 2680 wrote to memory of 5988	2680	chrome.exe	104
PID 2680 wrote to memory of 4240	2680	chrome.exe	105
PID 2680 wrote to memory of 4240	2680	chrome.exe	105
PID 2680 wrote to memory of 4680	2680	chrome.exe	106
PID 2680 wrote to memory of 4680	2680	chrome.exe	106
PID 2680 wrote to memory of 1248	2680	chrome.exe	107
PID 2680 wrote to memory of 1248	2680	chrome.exe	107
PID 2680 wrote to memory of 5200	2680	chrome.exe	108
PID 2680 wrote to memory of 5200	2680	chrome.exe	108
PID 2680 wrote to memory of 2720	2680	chrome.exe	110
PID 2680 wrote to memory of 3564	2680	chrome.exe	111
PID 2680 wrote to memory of 2456	2680	chrome.exe	112
PID 2680 wrote to memory of 2652	2680	chrome.exe	113
PID 2680 wrote to memory of 1096	2680	chrome.exe	114
PID 2680 wrote to memory of 2652	2680	chrome.exe	113
PID 2680 wrote to memory of 6116	2680	chrome.exe	115
PID 2680 wrote to memory of 472	2680	chrome.exe	116
PID 2680 wrote to memory of 472	2680	chrome.exe	116
PID 2680 wrote to memory of 5124	2680	chrome.exe	117
PID 2680 wrote to memory of 5308	2680	chrome.exe	118
PID 5308 wrote to memory of 3876	5308	RobloxPlayerInstaller-PRWHPR32JQ.exe	122
PID 2680 wrote to memory of 5584	2680	chrome.exe	126
PID 2680 wrote to memory of 5584	2680	chrome.exe	126
PID 2680 wrote to memory of 4996	2680	chrome.exe	135
PID 4996 wrote to memory of 4040	4996	RobloxPlayerInstaller-PRWHPR32JQ.exe	138
PID 2680 wrote to memory of 5680	2680	chrome.exe	145
PID 2680 wrote to memory of 5680	2680	chrome.exe	145
PID 2680 wrote to memory of 4228	2680	chrome.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://roblox.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa6d66c728,0x7ffa6d66c734,0x7ffa6d66c740
  2⤵
  PID:3292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,15392433151761587516,13270340044751124381,262144 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:5316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2080,i,17253734776357657555,14108528284770264634,524288 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,12338925319153416877,15607957343433429133,524288 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:13
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3040,i,8753576398788016173,18317100666202463424,2097152 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3052,i,1732494937196982751,10582646881206674335,2097152 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4644,i,15717415994366983960,16434107145524101195,2097152 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,548829987838629244,1674494465788636859,524288 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:5848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5544,i,15882196995041567041,14440813668730674324,2097152 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5596,i,11536481212059552163,12622614619393771426,2097152 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5844,i,13505882112763588052,9034356313092862200,2097152 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5580,i,13962489636418504345,14521870641360539829,2097152 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5812,i,10767996879841879120,1501858246331755033,2097152 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5620,i,17464308535721956937,9732131179777316690,2097152 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5792,i,10864382743392856695,17615807468624420535,2097152 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5928,i,16761109925683623676,10916022308379559792,2097152 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,785158925848682036,4115253538871738754,524288 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,1967278089025715370,18402873585482174844,524288 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:14
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,13115803858588552264,18383550335801442204,524288 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,13006587475043458394,7148243071054318805,524288 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:12
  2⤵
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,5499676157671692253,18359098001229510723,524288 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
  2⤵
  - Modifies registry class
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4756,i,3657366378322496160,8236485832297838154,262144 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3404,i,4123273411238430403,7050180462373395684,2097152 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6184,i,10172989331891810141,2691317560019160545,524288 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:14
  2⤵
  PID:5124
- C:\Users\Admin\Downloads\RobloxPlayerInstaller-PRWHPR32JQ.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller-PRWHPR32JQ.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5308
- - C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" -personalizedToken PRWHPR32JQ --deeplink https://www.roblox.com/games/15532962292/Sols-RNG --webBtid 1786199424577007 --downloadSource web_game_join -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 5308
    3⤵
    - Executes dropped EXE
    PID:4960
- - C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" -personalizedToken PRWHPR32JQ --deeplink https://www.roblox.com/games/15532962292/Sols-RNG --webBtid 1786199424577007 --downloadSource web_game_join -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 5308
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4044,i,4789280072872447796,12402745390725549410,524288 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
  2⤵
  PID:5584
- C:\Users\Admin\Downloads\RobloxPlayerInstaller-PRWHPR32JQ.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller-PRWHPR32JQ.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 4996
    3⤵
    - Executes dropped EXE
    PID:2080
- - C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 4996
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6060,i,7210223555451649790,5622090564130442526,2097152 --field-trial-handle=1896,i,13302814136235359705,3500516422270234488,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:7lKiNix7JMwZx7JE5lwlidVZMRo9ho0AR_27d6opsxXfu4udMHLkJktPK42-TIBKhj1pgRHflzz2tY9-tPWZCa0ASDGVaPVHx5Sm4SqlE_xFJUQXR5Bw06oXj3q-XRsq2PYm6qzyGVVbcfSRctTliMpazorhJweqxoZcdQR-DA2OUnlz27nEEoLp7CwkuDQftFy3uOmsywx6BzJYAj4P3Ghd-LLQ0Aw7C6K8cHo5R5GW0pHDAy3JPzOSn1yuAGX2AcGxZ1gT5V40BC531M-ZjNpfdEXgdsK3gbX0xqXkdQgGaV5R7WzMpSSmULoebdKJoLNY3WVw47qmTs0XrBrbw_RwHWEwi5uZevEt-KezjiWCJvvWf4cQYVOef-4sJ-KsM15a_dQAJI1mQTreTRuOxysWPFvtdcA0en64ixRxJ6QpV0FUao0N1jLlUPQz0tjotou6HJj_Ji92hsocvkfVugpwuV1N7Bg9p-kCHwICRbUyXY-tF_JmfWrAcWg-Nt4at_t1r_dbYCOoCEUOHXrJjcH0QKIL6E5VBVAQrPkJeKE+launchtime:1786199915794+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestPrivateGame%26browserTrackerId%3D1786199424577007%26placeId%3D15532962292%26accessCode%3Da559c5d2-6c63-42c4-b164-3b88030ac9d7%26linkCode%3D%26joinAttemptId%3D663be08d-714a-44e5-8ca4-115fdc5ad037%26joinAttemptOrigin%3DprivateServerListJoin+browsertrackerid:1786199424577007+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  PID:5872
- C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:7lKiNix7JMwZx7JE5lwlidVZMRo9ho0AR_27d6opsxXfu4udMHLkJktPK42-TIBKhj1pgRHflzz2tY9-tPWZCa0ASDGVaPVHx5Sm4SqlE_xFJUQXR5Bw06oXj3q-XRsq2PYm6qzyGVVbcfSRctTliMpazorhJweqxoZcdQR-DA2OUnlz27nEEoLp7CwkuDQftFy3uOmsywx6BzJYAj4P3Ghd-LLQ0Aw7C6K8cHo5R5GW0pHDAy3JPzOSn1yuAGX2AcGxZ1gT5V40BC531M-ZjNpfdEXgdsK3gbX0xqXkdQgGaV5R7WzMpSSmULoebdKJoLNY3WVw47qmTs0XrBrbw_RwHWEwi5uZevEt-KezjiWCJvvWf4cQYVOef-4sJ-KsM15a_dQAJI1mQTreTRuOxysWPFvtdcA0en64ixRxJ6QpV0FUao0N1jLlUPQz0tjotou6HJj_Ji92hsocvkfVugpwuV1N7Bg9p-kCHwICRbUyXY-tF_JmfWrAcWg-Nt4at_t1r_dbYCOoCEUOHXrJjcH0QKIL6E5VBVAQrPkJeKE+launchtime:1786199915794+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestPrivateGame%26browserTrackerId%3D1786199424577007%26placeId%3D15532962292%26accessCode%3Da559c5d2-6c63-42c4-b164-3b88030ac9d7%26linkCode%3D%26joinAttemptId%3D663be08d-714a-44e5-8ca4-115fdc5ad037%26joinAttemptOrigin%3DprivateServerListJoin+browsertrackerid:1786199424577007+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:4228

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4640

C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:5200

C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
"C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2340

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\UnlockUnblock.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- System Location Discovery: System Language Discovery
PID:2512

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.7MB
SHA256 eea5136d2e39678414ffacd6b0cd17d827b94ca5e09e9468a07da262ccbf226b
MD5 a5f81d2116ef82c09ef6390931e3e516
SHA1 41bf5bc16a0461378735c770328db29958f219d5
SHA512 ea06f9a9da51c5f9121a15fe82571cdbf88e49bd142719d3217436191f7d10c6c1c99b197f7a0150b1d0200a529f0db5bb82046d39f3f178a5ab4cea9cabf121
SSDEEP 196608:Zjj7ZtY620KULyMqDzi1msxtpEdDHTXom5KRZck3T:ZDZKli1msxtGFzXom5p8T
TLSH
T1B3A6BF22B900C032E8D100B2A6BD6FF6993D99341B7954E3A7D45DBD5A305D33B3AB1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppSettings.xml

Path C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\AppSettings.xml
Size 144B
SHA256 d5de39863fe721668ce1e115e0fc55a7c733747daff6235d27dad3d160c84dbb
MD5 431a6eb20932ec1c56682a1f60d231d3
SHA1 40bb32db040cabade103c21ba5b6f811dfb0773e
SHA512 0969b9484bb7c661d4e0452ff1c77396796333904b39f24c56d5a92ac4ed4ebde9b8981a985c6950b4af2852e8d9599e071a51ce4f9ef21ead778a2fdc76fcec
TLSH
T18AC09BA45351C4149795CF14977DF690E3B1797444504498D8A1785A0DC51D427D53A3
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.dll
Size 22.1MB
SHA256 6ee5053665a3d722337d0e14becbb614b603b19d952538e3eb9ba6b76cef2ee8
MD5 c7adc2b645f3f538434e149310b2255a
SHA1 5a6ef8f384f6eff5898d72a4c9792819490bfcab
SHA512 80038b6c6f0053844c55ef1d9d0be82ad2c0c8769b3805b69d2a6203cc42c69cfd56ff96ef38372fe06c40fb7de6ceca1124e4e46dc935f38ac8f3cb3c5621a0
SSDEEP 98304:HAISODF7F+aFnWEFuqZ58PHs5bHHVwpWYKUTECZZD5j4Bbf9yW0AAYYqddfeg5Vl:Bxe5qjJPYvH/FabgalDOSBVjDrNhIHHe
TLSH
T15C37BFCFE8D70AA4CAA19070E15F67E3EB62714C5A582DF346A50120363376E265DF2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roblox Player.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\Roblox Player.lnk
Size 1KB
SHA256 fd207e6f70a86c9ae92af2c76aac7d9b67fcddf88e1bf7f1212a86ab0f08db65
MD5 81a4ce5f5eb616f9361e01f22b86410d
SHA1 f17e6f5b5dcde8b8cc2b7992e46638489893449c
SHA512 4506242e1720a308ef8ac2904217b523fc99487f27adb0c4cd19314dfa19e0fda983666ddea729b3824d2f40703b9cf9dce176e471045be02ea3ad9088e980bd
TLSH
T152218E314E66273AE1B3C63269B553A2EF317C81FA599F1D40C623450DA1200E9F8F3E
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00003a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003a
Size 51KB
SHA256 bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760
MD5 588ee33c26fe83cb97ca65e3c66b2e87
SHA1 842429b803132c3e7827af42fe4dc7a66e736b37
SHA512 6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04
SSDEEP 768:VtCYamkOlFDUPktxoMggUfuuyDS2/wNsr9qdep/t0LDCzBr8VcdYM2YLx+jYRatF:/HamkonKVfM/ks9q0Nt9rnLZ4jYcx03+
TLSH
T1C83302F9E03A27AF3A55A372F131FB506455EA8C82FF4789E87DA3508EB60560F03084
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 06f3bd04cd1be0f2dff82163b19cc7dffcc69a93364aea0aaf4f55393716c963
MD5 725161cce8f34d8b02691b00257a1b8d
SHA1 7e93bd23f45fb79c3d81cf07e5a69fc1366aebb9
SHA512 fecce5c894d4145cf3a3a7348e9a970a921926a3d95593f41c2c6834220dacbc28f5322045e4b1948bf5375f668d6ad93699051a7654bd2511190c6729811905
SSDEEP 96:s7Kh/Tc00b4vgyMVC5237wVBwBjbVAcFKNwZ89f:sWhI0rqew5VnUNP
TLSH
T18DA1200450F19415CF7860F1216E4FD6AA213EA3CA3A7BFB4D279CAE5093EF9C1A9445
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 196fb0d17515a37f5b84432001b86ab842a7df4234477d990df35011836b8fe0
MD5 178d1f75136713aadfa14936ccbcb686
SHA1 206d94eb324340f31a1a797a898b9b89ad8096ef
SHA512 1031995f5d3cd87e6cc968b10b8e978580ff7681c4249efe5b9dc0f18200dd6178af1be68d04985fe0111664a00d4742fea5a6adb8f09385395f9f6f9664c192
TLSH
T1C0413D09A8F0A813CF9C71F9766B4E87DF043D9742023B9BAE446C5C64639ECE1DE546
MD5 SHA1 SHA512 TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000004.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000004.log
Size 138KB
SHA256 c46eb3e1c89c293f9d6b55addcf11c909f18a3b49e2665ab1b233d28014bad3d
MD5 2624817a799f26e5772147944ce48388
SHA1 09e89db070c8cf17802d72cd87108a915c3bd2bc
SHA512 1a5fb7ae39dc7fc73f7f7bf518e60834d7836a3cf8f821ada47ab6e0dbf5dee860ac66deddfe521a796c4b2fc74240adcded0d650cba3f2b79ca4e287c6f2348
SSDEEP 3072:G8i12XWbffIk/nidJP9P/FGFnbH4OBTkXg6F0SOSv86RFYDAvlC98WIeFOZnRnEU:ZxB5
TLSH
T1F1D38B2F9B70D49DD0F386FEE4821FDA83553B457DCE462BA09472EF45720E29829227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000005.ldb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000005.ldb
Size 1KB
SHA256 5926ce1ba9d3206c2d8ba45b0bd1aebf5b06bfb64987923de69199c5e31b145b
MD5 8eb391f7b21909b1090cd305a735881f
SHA1 2affe3af2eef01683026dd35b7c6d3d39a16d04b
SHA512 75d520d3411dd9fbcf1aa2aa8cfd048fb00be679e4e64d05ff04c052f1d1eead34a59855ac5549d6623a0226bacdc657304ec4b96f67a64e6c4c2ff2e8a5b782
TLSH
T1D631A7228BDD843ED9090B3385EB42FD87F2B68576528B863670A71D0D215071DF339A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG
Size 675B
SHA256 1d00b2e098b2434fe5daacfbc89ea63035135a6d4538b9e416b010f087d7f3d4
MD5 a992ba2cdbd440e2c33ade6d6c97ad0c
SHA1 2a818165e6b8352befce47a24d2a318524b309b8
SHA512 29a87e0c16f23f4dad773bd579ced8599e5d34fd825ec42a13b63938198178bc297d9498a179ee02cc86a233e7ca8381b88119642ceee80a72fe7a38ce783eff
TLSH
T1B201F4EB52C594AE09D0C127E53C330ECAF3290DEF8EDF415F84F15512C0008A0EA670
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 100B
SHA256 617971fee91d07f96621910d355ab665e1b6425ec5053f63aba2b3078feb534b
MD5 026e1247d806572359a4662bf8249bf4
SHA1 651ed721c81d930df59f92075372b0f8a0574e1b
SHA512 793adc88bfe383a595819fed408c52d7f719a0422503973c614ad7ebe3481e8567f55866727c9cc250006931bceeaa7fbc9d4a8410063b995208715e51172b97
TLSH
T19FB0123097D10C99D0A11438B4FF4284C52562907103D7593518402C0C025004D48B07
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 4582643f69193257c57064efb9069277485319781059d25b355dd92ab7b01d21
MD5 fc6b9aab9d616b393a14cdd05243fccb
SHA1 6ffb6d49072f7eaeba7af58660f68ae752d81aa1
SHA512 da368801c3d65f2d091a76dfaf7e8c841d13673702f126e5c9854ee9a4c137d0a5d111e2d20d0435c120e5e4107b41cae022af9b370fdc1f989d3645a3dd3c6e
SSDEEP 192:DWIm+u+Lr92q/N9XAfjPiQTau0X1MxQBJnHjuGLTHEy9eNUpZLLHxgd+z8fhDH/K:Dnm+bLZ2q/N9XAfjimau0X1MxQBJnHjX
TLSH
T163027CF753B1C96DAB1696F0DA09AD1B8F580530071C78B6C9E07E1793B36B1E201B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 23c2e596cbba4a4c8b216b623bc56f9bee29099de9d1e7bdf2279ab95429d0f0
MD5 30b2333d6be01a4c5f83a6a5d9ea08a6
SHA1 9f950d4801e9626efc153918a10a0662dc5e880f
SHA512 c2fb0f9b3a1774d0905b6fb7c3318df8383236ab3a8434f00365913759a4fba0958f20756384a35fd46562c841d97e1ceb6046a224af6a84854fb9e07832a9e0
SSDEEP 192:DWI+Bw+ZaIa/N9XAfjPiQTau0X1MxQBJnHjuGLTHEy9eNUpZLLgd+zfha8BH6Hy:Dn+BhZaIa/N9XAfjimau0X1MxQBJnHj5
TLSH
T10CF14CF753B1C96DAB1696F0DA09AD1B8F580530071C74B6C9E07E2793B36B1E201B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 39a07a715dd453e929df2eac1202a434c43281216d979c0a41e36e2a8256df48
MD5 5b726239cc39692b0e077e3cf2992d95
SHA1 f67ed00b64f119504229781c33237c5caf55a726
SHA512 63e6c9f9ec0cdb913ebac98729c303894ea0e6bd8dd139b0b8e76a72a8a7acb33290156a6f8edb4a941ab731b5caa6e5e84fc0c035f61a912c14880a7882d4de
SSDEEP 192:DYIiud+ar92q/Na97hHafjPinQTpgeNyU+HEu0LX1THjuMGlHxfx9QLBLJnzK:DFiuoaZ2q/Na9tHafjinmpgeNyU+HEu5
TLSH
T144026BF353B4C96D9A1696F49A096D1BCF580524031C78B6C9E0BE1793F3661E201B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 4a51bdf265b7d9a3b47bef95c4ec550d1500e920d83628664db6509c3bb24fc3
MD5 319b42a6b203c4d7163ae7d0b920af93
SHA1 c22bbed8873102f3dcdfe7a884003e2f3e742715
SHA512 e435d37fa02f4964061e18115d290e14693f398639747b424de28d4f56423d9252ba1f97bf9818ec5705b8cb7700ab986e3462d1a46fb8adb3aded4fad4c19a4
SSDEEP 192:DYIiud+ar92q/N9XafjPtQTau0X1MxQBJnHjuGLTHEy9eNUfpZLLIHVgd+uH8aK:DFiuoaZ2q/N9Xafjtmau0X1MxQBJnHjO
TLSH
T131026BF353B4C96D9A1656F49A196D1BCF580530031C78B6C9E0BE1793B36B1E201B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ec76f7db96661387277faead43a1f33e5296745e4975bb248669122aff5c51f5
MD5 4056f0bd5ce37cc6cd079042a236adfc
SHA1 667473ac8a4e9429138def400da51a5c47d93ce5
SHA512 f81beedce3a5e6ea1ae7f19ab8192d4fd0efa439d61d72d8e6b6634c8c624f3113424fbc99f9e8f1ebe702881b45607593895dbcc554b9bb8f6a89f9204f9eb4
TLSH
T1642178B7C6D89A3D890156F8A7156F1BCE290D18532C3D27C8E8AE1B97E2875E20055E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 f1d34b8d7735d4905e10d9d1614fbb0b7f808ee26f4155c2f97c1684230311c4
MD5 ff3226db54596ee69bc384be11de17cc
SHA1 8af07b93a14fdb9514ae4b93d686bf1c1b76a4fd
SHA512 8cdea820589ca18da8583f5412cbcdbc598912dd504af9df2e6ef8fe5a20f7c4fec8cd5b3986bb12b23714a5437920ece6cb21a184dd2db57cc0a645cba8db35
SSDEEP 192:DWImud+ar92q/N9XafjPiQTau0X1MxQBJnHjuGLTHEy9eNUpZL2HVgd+z8fhHHay:DnmuoaZ2q/N9Xafjimau0X1MxQBJnHjH
TLSH
T1D6027CF353B5C96DAA1696F09A09AD1BCF580530071C78B6C9E07E1793F36B1E201B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c1da2cfd0005c5da9431be903a0a27a3145eac77025cb622032a41c4e220e7f6
MD5 a7ac5662573bb5eb0859e56a55c476ad
SHA1 354c04351cc6110f8e10fad55c72eeef6613a29e
SHA512 b23e95c0462db784dd20c823239f830a86a326dad330a5a07a8b5b21aabac43447a7102de934befed21a691e9ec348f9601972aa782f05b1e7d0a26089954c30
TLSH
T1D22178B7C7D89A3D890156F8A7156F1BCE290D18432C3D27C8E8AE1B97E2876E20055E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 4cd135df7dd050d241b8d8123fad098938b564a0ca5a3cd8b400df7d5fc38e44
MD5 1f2c3e12ec1676d754c007c04ae4c6c0
SHA1 6beea62627d9e9940221cc63b7e24c491283fc4b
SHA512 2b286d321fce9209da04ac21237c53caec8262a0d907e424a611d5040a4968f62a1b0927d29b55a957c15017258a0a05b21c8153667f4a015915bc2b8e918702
SSDEEP 192:DWIm+Bwkr92q/N9XAfjPiQTau0X1MxQBJnHjuGLTHEy9eNUpZLLgd+zfhDH8BHxy:Dnm+BrZ2q/N9XAfjimau0X1MxQBJnHjJ
TLSH
T149028DF753B1C96DAA1696F09A09AD1BCF580530071C78B6C9E07E1793F36B1E201B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 f10cc7eea89e937d8eea1dfe03ac004ea46c96c3fce64d2a7e9d2fdcd613c2c0
MD5 f0165a023e658f2cceceb8cf55ea34b1
SHA1 3a1c78b3c11d142ec514b344ed5348802472d437
SHA512 858fd78469ff52e1aa359a79c9703be9d7fbcb66b38df90788a391c9ed96eb2494fd8ec21ae25d28f46da4c046323a6fb2c78dc9c5296afc3135e298d2ea7d50
SSDEEP 96:+AUOQUXtkUIKUjIUMJU0/UbbYzoU03UiUloUIk/UUrhUteUOowUMU/AUSXYU+rUH:+AU3UdkUhUjIUMJU0/UfYzoU8UiUiUI8
TLSH
T163A198ABD2BFB46B242D197B1E05780969B6B43511A6A8F8DF63817DB1C34F31B12423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 be9ba616983467abe7f7f3cfa26b7c9e9f6ec10e167fe02d794bbe4d3f7bbf9e
MD5 71d33fe83f9e011197982e1f7ad052f3
SHA1 3d1bb57d1ff77d580553afac30298dd388cd67b1
SHA512 3af51be9c387c844dd964280ba01502fc4f83a5224492992309cd3700db358c3d108cc1228251a9e10682e3e035ab45e702d7bc23e01b905287f57abbfa71f94
SSDEEP 192:5RyN7TMrv70qvZPRpStX9pHsb+WNntLIWITU7BekPI+VyIsnAUgE:5RyNXMTnZXcTwNjIU7w2E
TLSH
T1B342B86AA9107A3B6CDBD21DF9667B53E2F5102126D42E84E7FC892C24E79CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4371b1696c3c0fd29d39cfc4a382bcddb57b8023013465f54d7927857c64cea2
MD5 6996b0c357136be959a96bab732e7219
SHA1 a5a1a561cf5ff235690526eb0e0fc8f6a1d68185
SHA512 6a96a3b7ac51dccbe7d7b788b9da5dea6e8e4debdacf37b5189861e60714f25efd91e63d582ad658de562b4d874a5a00eb2e515564cc35198165d7ba993c76c5
SSDEEP 192:5Rad7TTv7+qvAPRp2ty9pHsb+WNntLIIW2msBekPZ+VyIsnAUgR:5RadXrV6XdTwNW2mKB2R
TLSH
T19D32A76AA9107A3B5CDBD229FE667B53E2F5102125D42E84E7FC892C24E79CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 59855c4659c8ecea5cd84ad1b37253346cff561877e383efa6aa8a4703ddb620
MD5 5e8a4e970323a4b3e38db50bd2eeffc7
SHA1 d8b9a0faa504dd0b74c1f450118295b66c887ad0
SHA512 ab29a4e7e4bf49423c72036e3b374a90c5df1377d0088c731c131f33cb5beffa410510095924d1748f67a449a6b6ac6438dcbd25d574e7f9347fd519695779c4
SSDEEP 192:5R/N7TSv70qvZPRpStX9pHsb+WNntLIApYQBekPI+VyIsnAUgE:5R/NX+nZXcTwNlYuw2E
TLSH
T14152C86BAD117A3B6CDBD219FA657B53E2F5102122D42E84E7FC992C24E79CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 28bd5ee799b1121c376c40899b11717a1db69d79bb4c59161dfc08f054b4f99f
MD5 d87289b69d6f1bef141c6d7e49ecd01f
SHA1 85113b90c7047747b7c978ed1de1a4f3253113c2
SHA512 bc30598b6cac9db7903865b371e7caeb6059de611db1a2216109a3909705528c779e9e068cae2dcbbd7a391fd48d0d59809214cce80f20edbac0eb532b772c58
SSDEEP 192:5RyN7Tbv70qvZPRpStX9pHsb+WNntLIOU0KBekPI+VyIsnAUgE:5RyNXjnZXcTwNa0Aw2E
TLSH
T11842C86BA9117A3B5CDBD21DFA667B53E2F5102122D42E84E7FC892C24E79CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 975fe053d8aeb25b28013be0abb4f8862d620100ae703af6ca37a625f078c7cc
MD5 bc47a685eff873a4c7eeea744ea1dda5
SHA1 87824779c6549908696a41805ee471a7bdc5180f
SHA512 5fc0f0e6bd2198e2a1541aded94b6f3a07cee436f0b17c467ecc293a837f946601b19b127898e7130bfda5f1549879706d720613ce2d1a8eebbae3aa6f0b35ff
SSDEEP 192:5Ryd7T6v70qvAPRpVtr9pHsb+WNntLIbhYkBekPm+VyIsnAUgE:5RydXWn6XHTwNSYye2E
TLSH
T1D642C86EAD107A3B6CDFD219FA667B53E2F5102521D42E84E6FC892C24E79CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4995e5c2aee8948acdf13caa8d56cb168e0a39cdb31f0b08cc45f5bc2b8412f3
MD5 39be89a8e40b8f2dd9e8a534bb8097e9
SHA1 5792806530bc25b7cb75746a0d53da83c1ebef20
SHA512 722a7a4cb002be44553010aa7090f316e7d8934a3dd3862ea9c5b26e42a6a7ef5c0a1f67d2c52657fc4490c472e18605ab40a928da4b2b076ebdf64262fdad4a
SSDEEP 192:5RyN7Twv70qvZPRpStX9pHsb+WNntLIOU0KBekPI+VyIsnAUgE:5RyNXsnZXcTwNa0Aw2E
TLSH
T1EF42C86BA9117A3B5DDBD21DFA667B53E2F5102122D42E84E7FC892C24E79CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0edd38ce20fa2e35616c56ab8e7dfe8e61e54af535f03a3bacbc27ce300cec2b
MD5 b19f56a4fba4640c111e72101a0439dd
SHA1 42b6e0bef8de3056edaf8e2645bb6517addca659
SHA512 56c8d56ca155f5c62ef3b4b0463260dd81128e3a176ee6b3a65fd73338d92b86d85630d13e3da7f954dd9bae485904d6956b710145e23cfab75dec3fc2e16fbd
SSDEEP 192:5Ryd7TVv70qvZPRpStX9pHsb+WNntLIbhYnBekPI+VyIsnAUgE:5RydXlnZXcTwNSYHw2E
TLSH
T1D042B76BAD107A3B6CDBD219F9667B53E2F5102625D42E84E7FC892C24E79CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 437e21d93668687c67db3811daef14b53ff4e61ee9473bfb1fc8fede8e1ae7db
MD5 d8aa759c9a29fc1a99854d2db2669b62
SHA1 eba0ecacf772f6a5f444801c5c92a78a2a55fb1d
SHA512 0d3f4909aaf1830c56fd2bcbdbf09d4dc5d34c9310f558e6c157845f6da5e2c359d361676bbce5817f577e5c8bafa1ae6ce655aa6c05083ac46a4a98a843f3f7
SSDEEP 192:5Ryd7T6v70qvZPRpStX9pHsb+WNntLIbhYnBekPI+VyIsnAUgE:5RydXWnZXcTwNSYHw2E
TLSH
T17D42B76AAD107A3B6CDFD219F9667B53E2F5102625D42E84E7FC892C24E79CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c2560ee80fbbc414b8a07f4f7be95c6d291199faa436d974d93ec541e0a87416
MD5 be46f16710f70e25874689dbc9c70952
SHA1 c3cffb0a1d11e734ef449b1193b48f75b4c652b9
SHA512 8f0a66177d5a85a2d63053f22e9c07a41e23525154871b91f3b8b4603144472104499f792702abdab4995a00807d6cb596e8ed291e07adbf3ac990b22ed8e7d3
SSDEEP 192:5Rad7Tuv7+qvAPRp2ty9pHsb+WNntLIIW2msBekPZ+VyIsnAUge:5RadXKV6XdTwNW2mKB2e
TLSH
T18F42B66EAD107A7B5CDBD219FA667B53E2F5102122D42E84E7FC892C24E79CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 57cd44590d12ba692b274f4e683525fed95f31f6a945ad3d5657821c1e0606c2
MD5 4b519510fc68d9c3bf67ffca891bc60d
SHA1 aa6b479f2592fd156613079b954e1ca07984d0d7
SHA512 0dc54ef6b856f7b32300897afef727cb0498b1a5fea9b5f0546ef185583022f90446a2ae073f9172b1d2924685e538749929197a27dca971c401d200cee269c1
SSDEEP 192:5RyN7TOv70qvZPRpStX9pHsb+WNntLIWITUXBekPI+VyIsnAUgE:5RyNXqnZXcTwNjIU3w2E
TLSH
T1EF52B86BA9107A3B6CDBD21DFA657B53E2F5102126942E84E7FC892C24E79CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 83a8cb68a3c64ecdc103d5e5d3a67f6b9f0a4a12e003868871d6a91dedb2df66
MD5 1347cdf48c365d1c3521e936518a605d
SHA1 7dfef96e4624ca0c5f9e06db4f7a78b189ef6fe8
SHA512 4e7936919685d17794d3462a5af834c71446f7da47622c9c9550ba7a704049fa73eeed8b87d150c7c595484820b10646ddd0bb2d7211064938e5235ea4f368e2
SSDEEP 192:5Rad7T6v7+qvAPRp2ty9pHsb+WNntLIbhYkBekPm+VyIsnAUgE:5RadXWV6XdTwNSYye2E
TLSH
T1E442C76EAD107A3B6CDBD219FA667B53E2F5102121D42E84E7FC892C24E79CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 fb377604f2eff03c4677a647c8c94a33496bb6a03f2ca3b617f73d6d02079dca
MD5 c879080c9ba72d4bd02fa06950d0d4da
SHA1 51eeebb8e8d90b5930e9e2aca5c65a6a5e11bd40
SHA512 b3049b1fedf12cf8e69c46588916533fc10ffee805ef2066c1e5abada55bbd8178d890f43ff726bdcb387c44a2df1d11d1ba3d3d6ee4537f088d19751b4a55f8
SSDEEP 192:eLE4K6Xn7KxkXqK4I40pUZNCgVLHrKHfFKslEiTtXzKD/ML+ErUkKNxn50i4S+h:uEjEn7KxkXqKf/pUZNCgVLH2HfgslLth
TLSH
T11532C727A48E9E7F4FD8E51CDC477F4B6CB502567378082896FB9C0403AA78A214A1A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 da86b383b0fc729235e9f3c7ec647d1785b804301a15b8a9ac43913d1453d0fa
MD5 81a4a9c14ed7564d34c23295096981e4
SHA1 c324f4b707605e2ee2da7dcbd44dd9937c0066d7
SHA512 0b5fc897c911fa3b415e4dbb34614c1f9686165d9c6e6add56cc006492daff087ce117fd4bd574be6864f65d87dfdebed6d280ff0f725b5938236cddb85adac1
SSDEEP 96:EbJ0d+Ar2aetJRxW2rgj0+f+U+/EOeztSl8h4otop5+3DyB6n/zGyvTNchCzb3sa:Et0Nr7OJRPrL9/E/iU2KSqaIcMnhfRy4
TLSH
T106C129B2A83DACB34DF3D516B5023647CEA460BB5964AF14DAD52A0C00E70EC1386A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 9346c0909107e1eb1c7f9f2d606c5aa447bc7d971d570eb6d355ac0c7a1bc1e6
MD5 8ef32e19e8c10a74af5d6be32406cf6d
SHA1 71cec78299e7dad530131fad2b9007d7cc93c7e4
SHA512 90ee3224feea2e91a394af68cda2e456f886347bad3fa607674dc1e0da548d6f44202311665649e2dbd26d0f35daacbf515a511315eae0441551a019ab0f4a67
SSDEEP 96:EbJ0d+Ar2aetJRxW2rgj0+f+U+/EOeztSl8h4otop5+3DyB6n/zGyvTNcqQfG9yB:Et0Nr7OJRPrL9/E/iU2KSqaIcffUy8ID
TLSH
T1A9C10AB1986E6CA74DF3A445B1033E47CDA8616B6928BE58EAE92E0C00D74DC1383627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 8cffe854debe2c5957fb305b8f4a949de9ce5a8b3790cbea92311fe886dc952e
MD5 453003fd89e5b3b467258eda25736090
SHA1 e4211231f7e22619be1c069b1b9c8b1dffd94753
SHA512 8893a052c55decf3d2832e20a287e054eefde40a406dd86a52ad04c317674559fc705e68cfb9b60dec166782eeebc9d22b6c82a8b643b55cf555d6c7ccbefd36
SSDEEP 96:EbJod+Ar2aetJRxW2rgj0+f+U+/EOeztSl8h4otop5+3DyB6n/zGyvTNchQf99y/:EtoNr7OJRPrL9/E/iU2KSqaIcCfDy8Il
TLSH
T1A0C1E971946EACBB4DF3A545B1033E47CDA8616B6928BE58EEE92E0C00D75DC13C3627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 ef63dfb81993f559e2d0483c699a4e9cdf069ca78c590374affecbb3b6533d45
MD5 fd375302c44743306740fc4dcdcc1071
SHA1 3772578ea97319cacd7de879f3b652e3de677029
SHA512 f952ccb4eef51d377856fc305126eb5843990b49f4b18f9a841cd353a3e7f251b2e6bc83fee53e5950f85ae9b89aefb7e74bbf83c3b4773c077dcf2fa7f4536e
SSDEEP 96:EbJ0d+Ar2aetJRxW2rgj0+f+U+/EOeztSl8h4otop5+3DyB6n/zGyvTNchQf99y/:Et0Nr7OJRPrL9/E/iU2KSqaIcCfDy8Il
TLSH
T129C1FA71946E6CAB4DF3A545B1033D47CDA8616B6924BE54EAD92E0C00D75DC1383627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 9927f172fd2712e66b42f80ce0314a7a0ab96cb6b463c350ebb84251a8d50970
MD5 1d252ca97d564bf585e67ec4645028da
SHA1 c2277ff891b95337d4a2f18f1ce195deb184ae5c
SHA512 f1f418c0230f2909eaa7e42a1aa7bc053e46fa4b4f23ad7ab59129c831f9b638d9e6c5577b1f88a1b34eef5b18976ae6fd1c2521cc41d2f682805a3e90b0229f
SSDEEP 96:mC0d+Ar2aetJRxW2rgj0+f+U+/EfezeRDotok5+VDyB6JGyvTNm6zj8+PEhiv4a:mC0Nr7OJRPrL9/EtDUDoS9Imgj8+shM
TLSH
T13DA11932A47EACF749B38549F5563B07CFA4717B5A21AF44D9DD2B0C14A70DC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 0c481bca30a922fe4a41259d6e62156f66d0ebaad1e2a7df6c8c3e40f4cb2dcb
MD5 5549e25bb7b824467264432ddf928cc8
SHA1 3af8e1a8f2464f8fa35413243d5e6afaaf9fbe9b
SHA512 c4a0b63405cf74956fc6ae60b9b3a41ae9c9632f1f278b0fd6c1ef66e4ae5f26793a91c8f84da4fc4f9e9a6d335b308c75c46e086de75a4420407c43c856557c
SSDEEP 96:EC0d+Ar2aetJRxW2rgj0+f+U+/EOeztSl8h4otop5+3DyB6n/zGyvTNchCzb32fZ:EC0Nr7OJRPrL9/E/iU2KSqaIcMn2fRy4
TLSH
T1D6C11AB2987DBCB35DF3D516B5433647CEA461BB5960AF14DAD51A0C00E70DC1387A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05ad996224bf0ecb21cd232070fbbd2b

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\05ad996224bf0ecb21cd232070fbbd2b
Size 596KB
SHA256 16cd03787910fec0340c58cd4efd4ba47d1f00d61395c76693cd5db695db58a4
MD5 05ad996224bf0ecb21cd232070fbbd2b
SHA1 6cdfe9d46d3269e9e6f02883db3d1d14f0183af7
SHA512 f6cea90b1282aa0ac2554cb98335a5817186ebf4327458333ba1b160918b6e37c66ff6e4966d95ca11461017171900e4b1eb5e5324ed805c32537386f5dc7e36
SSDEEP 12288:Btj29etcNztbhDOlam2l03KHsvwyjwLKqneiAKWBTd+lPINsbtrOqefzK:v2U4jDKa5K3kByjwOqePjBd+jY7K
TLSH
T110D423A413287960EAE768E78E143C0E7511DF347F0737970A9097E17C6D7EACA609E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10461fdfb35f35cca13dbe35dcf21343

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\10461fdfb35f35cca13dbe35dcf21343
Size 3.5MB
SHA256 73c9d9a9333623a070ccc1e5f6cf325d83f1ef9ce35c4d255b66a1733f6e6a91
MD5 10461fdfb35f35cca13dbe35dcf21343
SHA1 42806bf7d078a0dfeb1e462bc9e5ad6e90159b7e
SHA512 15b6bc4c957ef618f56188227bcffdbda3ab990ba80362d3fe89f97e74a01763cd46bbbace7548d5a29244dbaa842da0c7f9e449b2df715f33b708a5a629d3ab
SSDEEP 98304:LnvauOC4zP8kaSRljlFUkXqUU3aSpTMKK7d7RSktipIWcLEq:brOCuP87wlFUgU352KK79toIN
TLSH
T107063389920D485BD1FD213F4523DDB085B8315CA803CEAA28DB867C7F6A89DF13E95D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d0390337d1a4a58e5514be1a9481ad6

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\1d0390337d1a4a58e5514be1a9481ad6
Size 2.3MB
SHA256 c79f0eeb2bca4905c585c50333db3c6f727a554f5db82e64948f93668fbc18aa
MD5 1d0390337d1a4a58e5514be1a9481ad6
SHA1 0c09b611223f335af2a42dbc371dc95ba4f18979
SHA512 382e5d7a61398d54bf15bcd928ec7755817fe92a860840efac6f6417229678cb1fd1756c5a7c82e02754a23732f63882c4a640bc6d73d28f30110d0028ae6fb8
SSDEEP 49152:DejtLQNcZOH6b3nbU/s3lgwvTS2sqQFIPg8Fb5iLcWvFXO2+xPh83+H:iJCcbz4/YlgwvLtQG4mULcz2s583Y
TLSH
T132B53399FB0A54B7BE60CE1753CF779A7F1882A510A033E7CED7ABFC1A79A404521406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35e4efb6e5fcb0ac5382d4b43e9d0027

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\35e4efb6e5fcb0ac5382d4b43e9d0027
Size 758KB
SHA256 2132437c0dca86c36bf4c101d2af3397d609920de169981c7985154e6cfd4b50
MD5 35e4efb6e5fcb0ac5382d4b43e9d0027
SHA1 4ff100e10560d5ed44981b3d67b612307810f8f9
SHA512 0c55e70ae668f5c4c3fc0c597e561604a6020309b31430b3524ab771c5bbc89b87e85e36be38c7c2d1f1e13bf52a0036efa026b1660a67a22236a07b276fe550
SSDEEP 12288:tMyCA483ATd74zErJkYnZEmFwlmgHTGs4ro5pvonOM2pI2cVWf8tq/d0yW9goz+c:tZA83AJc4JttFAmgH0ro5yOs2zfhPWqu
TLSH
T1A6F43346AB6E13DD8CB23FA5174448E3A2C14BF886CDC1819F7781E0A62C6F8855F57E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e27bf0967d73c6d2da67ae5b4baf73a

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\5e27bf0967d73c6d2da67ae5b4baf73a
Size 21.7MB
SHA256 ed5a66dcaad8d211502139866ce907ccbeb79a5cbea4a8f8c5a2e1e811810d4d
MD5 5e27bf0967d73c6d2da67ae5b4baf73a
SHA1 fa57bfe72a35e904a21559f392da9665a2d0aaab
SHA512 9b46bd9398de682788033c771b4ba476db2007ee7f02ddcacf767c51bb85b847c587414f085adcf26747b5fee38692a68701de74edd1db1c50d39fda762ff244
SSDEEP 393216:nNeOxv1Yc501QGp7XSSyDxwCjI7uTxA0y91UjgLT30Q96CvXNUXJB9qkRM:nNehp7XSNDxwAB+91Ujgv0QGZi
TLSH
T1853733BC8CF971870C1F9283B6C4E7DAFEA46568DB90EC913719A7C52B490B2347458E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7071af81f7fad1d26ec29b7699f2d96f

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\7071af81f7fad1d26ec29b7699f2d96f
Size 5.7MB
SHA256 21f2759a5148c427118911ae402be2a2def56f29bedbd33ace3ed2ed714422fb
MD5 7071af81f7fad1d26ec29b7699f2d96f
SHA1 0b0d2efd7915cba61b677389858e4a1b3d896699
SHA512 966824925a1446316197f19616854318a76047c1a20af4bdc34f41dcec60f7a93d68f2c69578be830c886610d094df90cbb757450549daa5e7a3ac43665e0fe0
SSDEEP 98304:MPozI9K4jo9oagQ0ParlUCuJ9P3Vt3yA/owp7PcA1VyzKSpPd7ibGGg5caGctpTc:Mg94jwoalYarlrG9P3VEkx7PcHf5xiai
TLSH
T16F5633D0AA7B040AD1BFF6704C2B1F144E998299093CED4E5D25D0B989D74F763EA8AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8afa4daa8041a80deef7748c1c5509b7

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\8afa4daa8041a80deef7748c1c5509b7
Size 127KB
SHA256 d8e705e813293521d7edd265799bca6bccec7524a9717a9ced3e2fb71bf7ea33
MD5 8afa4daa8041a80deef7748c1c5509b7
SHA1 3c5c53f1bb7abdd38b2fb2edb5ad517a5b2e4309
SHA512 7f6d0d395d1c3c11f4dfc14bcc515cb6f38da61fed42306608adc1cc5915d14d7abc5188df1f5297cb63da0b0541bbe4137c96b04bea49259243f6584d53274b
SSDEEP 3072:eV2Bk7YWRsKohFyopBzW1AT3rJsYcEpv+KBXmBkSuGv:eYBqPRsnRq7Ybl+wX0kc
TLSH
T16CD313783C789057E617E00621AF5273F53BC9D4A2B023D99A93D79721583F25733AA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b39e31ba671f6403be3a0151b164979

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\8b39e31ba671f6403be3a0151b164979
Size 81KB
SHA256 31fd7aa17f54056346d5bf1241814ade68903248b428a7e86450847445dcebdb
MD5 8b39e31ba671f6403be3a0151b164979
SHA1 11806056f07479396c67a16d7bc3f6b922a23a67
SHA512 bb9eac8afe2a66625f32472de70343f5dd159dc372f69d65bee633f8dc315108d4288d3e97e19807d3335c7d44d7bdccadadc37af5ebd867d0e397db431776a5
SSDEEP 1536:lvP9ZIqELBtsTZs1u++7JT32d4xA8ppYXFpfJ12+42tUES0psc506DrjHC:FP9Z3Qb6+oj2oCv2UQ0e6DPC
TLSH
T19683125DF690E4BCE54759FA88208130C8DBDF9838DF51C0BBDA7695D9C4208F2A9E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f379ec2b22ff106b837d79f7fdbf0d8

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\8f379ec2b22ff106b837d79f7fdbf0d8
Size 13.1MB
SHA256 6620658a6288e6b58b8d86aaef4e7734e10778974e9a01d364fc7aac4d35f10b
MD5 8f379ec2b22ff106b837d79f7fdbf0d8
SHA1 977223c04f192d8a157603c1f18d6d6a301e88b1
SHA512 1aa837f64e2d9652221ed5bdbf78c353e04a0536d09a3502a230b7f2f034dd404bef0e1a4ce57a42cd03f860f64965d94c2b638aa0994a3dd41fdbc6d751458d
SSDEEP 393216:DL5briJop9j7Yl/feBa5tMaNqGOGwdCUQUJ9Y2Ondq:npWJehYl/DFNDMJ+2Ondq
TLSH
T140D6339AE0F53A5B79933C7526053C970ECBF06BB59B152C24EB0452C2EDFF67401A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

961cd6b55ab23d2efcc9a7319191aa37

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\961cd6b55ab23d2efcc9a7319191aa37
Size 286KB
SHA256 7305e6ba5dabc3460ed5bd5fdcc9502c8f99a658ebd595e5b1b3ad61b0acbd7d
MD5 961cd6b55ab23d2efcc9a7319191aa37
SHA1 6ea59621de06891a4685bde3ffb08a33d3db1474
SHA512 bcc2c29c39688c0201c0ccf2d59c455f6e5b5fa9997c32f1e08583791d5e883c2084e72ba74aeb8d7308a9d8c2f31a05708e4356ac99749931a8eb43f79b481a
SSDEEP 6144:HvsEkFlF8j41IH3+uvUrx2lDiDWVVNydwlLlgMyRWf2/1e:HvdQz8nHFvSyVLgqeMyRWL
TLSH
T1015412BFC41604AFC172FB7B33F96912421C687B8206D45E9B7521B82F6B0C76B1B5A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97327884177381d0f42d428110b4c516

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\97327884177381d0f42d428110b4c516
Size 3KB
SHA256 b8d4802f5c25d188268bf6a3a1c72a00d56a7b3f7fe64bb7f5fc4d6e8f6b8a28
MD5 97327884177381d0f42d428110b4c516
SHA1 f1486a304c7b458dcbaa53836632d723f0e87505
SHA512 9fae3ae92fe1073f7e720eb6da6ad99c19bbcdf6caad9408feff07140d5df9f845f0e5f652ae90a87185bcfb0a90287b4e0da174f1b0ea1e7055cab16baef369
TLSH
T1CB616CDD8D95121BD31F963354055E668C7FAF2AC006224F30201C2ECC0AEDF9148B7E
MD5 SHA1 SHA512 TLSH

Submit Download

b0eaea6e38883c2f552ebfc3c49a66a7

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\b0eaea6e38883c2f552ebfc3c49a66a7
Size 605KB
SHA256 bd9d84b18399042e0478ccdc989081d48a82279a498b36efaa197a317e01df76
MD5 b0eaea6e38883c2f552ebfc3c49a66a7
SHA1 1b60707348ac83d958ae17b165d073e5b2ac6743
SHA512 87fb0c3590563d24ec5c4f3400f586f5222588b3c221727b1ea7e90a84dc9f6188fbd5bc6f240b7b14409670b6780bb9c1401260ff48f95db27ac2a9a0eb745e
SSDEEP 12288:kWoEp4kmwpJpZMqvykVpQog/BCglT0w5pKmWTXU48aUB05C2U/JV3IPBxhKOTqzi:kWalwpnZfyoJMCgl4ApKmev8aUBQU/fc
TLSH
T15FD4234C1EB1ACABF456D3F9CD74DA888A10790E8F697F0F25F6309975121B11EAD08A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9871f068779ce99546156062901fdd2

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\c9871f068779ce99546156062901fdd2
Size 5.5MB
SHA256 8e330651c998fb78e5980fa3123d91f7e637c28080323b4689b6a853bc7f0932
MD5 c9871f068779ce99546156062901fdd2
SHA1 e1b26d672c2f29d84b9cd5e17b4e9321279971a9
SHA512 cc7ca33c95f008f4032f08df47fc8d7a97cad7af36fdc65c74653cc78d9dcdcab3ab8fe8a77740f8ba5ec3461b5c8f15fc0e52fa56a2e1756b670d3d299306d0
SSDEEP 98304:sVd+l797dCsnCavaYbq4fQXxhpLF/ciKysKLmd7YfSJAcEsnYdTGWaxGESu8hTet:XRZ7Rvm4Y1p/NK3KqufSicEsnWJDH9hW
TLSH
T1EF4633FEFE74093DC223AF367101985268268F55DB54511F242AA4B0EEC33979B436EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d2406ea0de423938d2d7ff8e65bf9272

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\d2406ea0de423938d2d7ff8e65bf9272
Size 10.6MB
SHA256 96d575ef585e65fe2297ab889335e5b9793375072c480718158e0ea052249fbb
MD5 d2406ea0de423938d2d7ff8e65bf9272
SHA1 770be0831d578c59a39c6fcf86e5ad9d1f103069
SHA512 d0b0d6be823cc772feb4561d02064187824549ff97f4deec360b656ebe8510cefa97375fee337b3533f6c8c2887176706c440842c08369fdbfbaa1310f6338ba
SSDEEP 196608:v8CoBjqyb3et3kK433FibjH7Lj3zPNgXgXcSpcYpEP0E26vnjpoxs8qcUdV9R4Df:kcyq3kKw8jfPN7cY6cE26v0s8FeSDVgA
TLSH
T186B63364D1EE0BEB85081E894C47FC96FB26C447C16889779FF2FA76F247DA810C65A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d78901fd45a60d4a363a9bd23de96d4f

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\d78901fd45a60d4a363a9bd23de96d4f
Size 299KB
SHA256 93d5c0bafd6130fccadf6bf12c4c4844a93db98f60c0b36b14bd0cd216b5c7e9
MD5 d78901fd45a60d4a363a9bd23de96d4f
SHA1 2b847d14561a91e2281db9a647e3b455d2d29a5f
SHA512 4414b8802a01791fff5e688b6ec93692e4df51b9b5a2d26815af5297f747daad40fd714210691861e350bd0707560435ba67213016895570377e8c43f3360872
SSDEEP 6144:j7bhY6n1UVvdL3rfcvvGji5vlg0ZWGe2wV0zejicnmZppWKOwYjKUTsQOO:vxyrCEyvlTZDe2XzejiwmrrYOUqO
TLSH
T13754122BDC01414FDC5C66FBF4AF80639C2807C75D6668BB52E934A649BF0D7A27B182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcfe8c976632c8f4ef80ed2e1876269b

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\dcfe8c976632c8f4ef80ed2e1876269b
Size 5.5MB
SHA256 96254cfd8828e3494013a6afb0f82823c51fbe6d8396a3705d8f8e4060cde0b7
MD5 dcfe8c976632c8f4ef80ed2e1876269b
SHA1 6038c50377c0389f922c5eda69f9d3cfea737f15
SHA512 8e88c1ad5d4aeeebe3bc339cd42622fdfd8d55e624cc83969373908a19e67f5357505146cb19382dd24c0e98d8ad065778598a9c43d449cfa16e4c661bd04bdc
SSDEEP 98304:N0Tdul0TFdExpV/Jc5fqP6PP58ynUTufWXMAtUcHoY4zxe4:N0gl0RYfitU6PB8iUT1VUR
TLSH
T1034612FAFF7D493DC177977992038812AC68641A9A2C650F09296C7499C3AC7DB423F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb9dd4d0637fd6ae21747e6b6a281d21

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\eb9dd4d0637fd6ae21747e6b6a281d21
Size 459KB
SHA256 5a3aae5657899b6452004f3f43f122cb6c166c99b7261efbeb965da906626ed8
MD5 eb9dd4d0637fd6ae21747e6b6a281d21
SHA1 387c79caeee5a5a850e328f8b9ce812b5048cefd
SHA512 f9b87df46149f2fe52690e3c906ee1cfc92e3196b8db50210269312999a56b9aff354b1b5c74da192b37646dcee5305d8afde6d2c80334a484b1a8a375950b5b
SSDEEP 12288:CtpZwzl7szmrFyHHU8ibAQXgwntX3dh7ZVNx:ClGl78WKHebAKtX3D7ZVNx
TLSH
T141A4235BC725D298D9A2D17EE22215BD68FF29AD8010F52A08015E417FAE70D6FF02DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec1f769ed9506391d785f75669d858c8

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\ec1f769ed9506391d785f75669d858c8
Size 2.5MB
SHA256 63dc92c92985b2e03a11958e20084b693fc3600999e8feb415c0bf536f03a97e
MD5 ec1f769ed9506391d785f75669d858c8
SHA1 3fd00a1dac6f5fe80ecf3c2bc49e8ceb83d16901
SHA512 acea989797a0e271500c54b8b8fc7ecc52dce019d02914368f9207596033d295d75e9f5b47df3645ff4eee0971029ab53c804f736d7af6394b930d64a8ee225e
SSDEEP 49152:DehaChfrRt5Ur6cQ+IP3f5sI4FVrbOjBenUofSqjNUTa0+lN3ms/cMCvIt6A:SUeR6zIkrSLof9jNUD+Xb/cMCvIt1
TLSH
T173C53398E9C53E16E47E36B2A2B1BE0188750533E8D5CB87C7AC06B498C1BC717D97D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd88c849719a2f9b3b3c00e11f4a5726

Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\fd88c849719a2f9b3b3c00e11f4a5726
Size 392KB
SHA256 89c381e30d07732520dc19b9278ac6238b7700cef5a93f72106f59f943539558
MD5 fd88c849719a2f9b3b3c00e11f4a5726
SHA1 67b614a9a1ea4150110a4f5a6bd91b09e735cf93
SHA512 c1a281ec73bc87e95979353b2e1fd40e80df37bb17e195c149bb6cda9cac7a4851cc9401a3bdb4a4c45938fb8966fa83efc3567198cb0815edcc86fd61e88c1b
SSDEEP 6144:12eJXmygy3QPE2GimMQHRSvSpbVYXPjYdFIlkAD8Ic+8/kkw9rMJE:X2rvmfQ6jRdr5NFkkw9Ym
TLSH
T1FC8423F6F40315F405B779FE0CEA5430A6E38EB18285622ECB2BF5460163CA35FAD665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Roblox\logs\cacert.pem
Size 223KB
SHA256 2eba303a7b3c87f0c52fa8f977b703ec6dea7de703f97644546d2d34e53e4cd9
MD5 2ef00fa979161001a3a5cd5169a7de48
SHA1 0d3ee6044ef954db79d4db9984cad411dfd4c3c7
SHA512 f0b7f015d3e766b390a663ca5b1498175fa241259cad73f4b8d2b9646b56bc08a698fea7f5a28324b9a59af1622296ef79d77830a50bce14fd5f02f7f9228fdb
SSDEEP 6144:EqU9NgI6FdZL52dTOgwQh1hV1AP2A2FTR:knh6fZL5mOi1hXAP+9R
TLSH
T1E624AEAACF953C4A28E3F094C9AB037ED919C3629DDAB0B31D593845C78972D61FD08D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8913724486d5e3c463c493b25346ca31

Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\8913724486d5e3c463c493b25346ca31
Size 64B
SHA256 5af7020b280851b532c0f99999ef912f20b73465467a439de05e1fb39cf9dde7
MD5 5c7ffb921ce218c157708dd9901c1513
SHA1 7fc585f4228d5f8992b0d1f33c2de1fcf333e299
SHA512 a6a5ffec55269a5bbe5c44200f7f2ca90083d8d67128f88eaa20da14a6ed240ee623b78e4a617e6b6e650361249e8e47bde801656d95981903607b7e04e4d413
TLSH
T1A0A0023A6602D03A8C9706B9B438591E4D945C4DE3601C589285D6883860F49B87B469
MD5 SHA1 SHA512 TLSH

Submit Download

Roblox Player.lnk

Path C:\Users\Admin\Desktop\Roblox Player.lnk
Size 1KB
SHA256 5089dfe7d07dee26f7936cc2751a5c2ef626331af35a699239448c0609b2555c
MD5 87693f3ce7f8470a933ad6fd43114bf3
SHA1 aca6b099c8f0672604546e8df60e4634e83299aa
SHA512 ef06d9d48aed8644680323b3dbdf71319295c68eec26179a3df07a081129595e0812b230f0a466cc71a7876bec30496bb49092072b4cb7256326f9e2e8df514b
TLSH
T1EE218E714E66273AE1B3D63269B452A2EF317C81BA599E2D40C623050DA1200E9F8F3E
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerInstaller-PRWHPR32JQ.exe

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller-PRWHPR32JQ.exe
Size 13.0MB
SHA256 d527cd3c5d7506571d5d6902cbf90015f05574a57d611b616052877957bcd659
MD5 d444176101c29a0b4a4edaee7215443a
SHA1 da4a9447fda68deaf9b4c57d2978d894804e2b0b
SHA512 185dbe780fe982009920c8a4050ca8f8ecbe1a87d1221dc8cd3df43c74e86436e7deee59c976ebbebd616656c2e5904aa3a9685d4241b4cf191a3b46f61edaad
SSDEEP 196608:MYBPWIdJg1wdZ/mwSSh48J3b8U16O5uJtmBd:NJXTg1smwS848Vb8BJABd
TLSH
T1F3D69D5AB2B800E8D4BBD178CA565617EBB1B41603709BDF17A046E61F63BE02F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download